dompurify

DOMPurify is a DOM-based XSS sanitizer for HTML, MathML, and SVG. It accepts dirty markup as a string or as an Element, DocumentFragment, or Document, removes elements and attributes that can execute script or otherwise break out of the intended markup context, and returns sanitized HTML by default. The basic browser API is DOMPurify.sanitize(dirty); the package can also be imported in bundler-based projects. The default configuration permits HTML, SVG, and MathML, including CSS and custom data attributes. Applications can restrict output to a single profile such as HTML only, define allowed tags and attributes, forbid specific tags or attributes, add tags and attributes, control ARIA and data attributes, manage custom elements and customized built-in elements, and adjust handling of data URIs and URL protocols. Hooks allow additional programmatic inspection or modification during sanitization. The DOMPurify.removed property reports removed nodes for debugging, but the project explicitly says it should not be used to make security decisions. DOMPurify supports modern Safari, Opera, Edge, Firefox, and Chrome, plus other browsers using current Blink, Gecko, or WebKit engines. On unsupported legacy browsers such as Internet Explorer, it returns input unchanged and exposes isSupported so callers can provide a fallback. The 2.x branch, ending with v2.5.9, is the documented line for IE-compatible security updates. Server-side use is possible in Node.js when a DOM is supplied. The documented setup uses jsdom, and the README strongly recommends keeping jsdom current because older DOM implementations can contain parser-related vulnerabilities that undermine sanitization. It specifically warns against combining DOMPurify with happy-dom at this time. The isomorphic-dompurify package is mentioned as a higher-level wrapper for cross-environment setups. Other capabilities include recursive sanitization of DOM templates, Shadow DOM support, and optional Trusted Types integration. With RETURN_TRUSTED_TYPE enabled in a supporting browser, sanitize can return a TrustedHTML value. Callers can also supply or disable an internal Trusted Types policy, and the library detects recursive policy configuration. The project emphasizes secure usage boundaries: modifying or reparsing sanitized markup in a different context, or passing it through another library that changes the DOM, can invalidate the sanitizer's guarantees. The README links to a security goals and threat model, an attack-class and bypass history, default tag and attribute lists, an online demo, and a private security contact. Its automated tests run across current Chromium, Firefox, and WebKit engines on Linux, macOS, and Windows, older engine snapshots, and multiple Node.js versions with jsdom. DOMPurify is dual-licensed under MPL-2.0 or Apache-2.0.