cure53/DOMPurify
DOMPurify
DOMPurify is a security-focused library designed to sanitize untrusted HTML input, preventing cross-site scripting attacks by stripping malicious code while preserving safe content. It functions as a utility for secure document object model manipulation, ensuring that user-provided rich text can be rendered safely within web applications.
The library distinguishes itself through a single-pass, mutation-observer-free processing model that operates on detached document fragments to avoid triggering unintended side effects. It employs recursive node traversal and context-aware logic to inspect and neutralize dangerous elements at any depth, validating all markup against a strictly defined allowlist of permitted tags and attributes.
Beyond basic sanitization, the project provides comprehensive support for browser-level security standards, including integration with trusted types policies. This ensures that sanitized output is compatible with modern security requirements, preventing the injection of unverified strings into sensitive document sinks. The library is available as a standalone package and includes a polyfill to maintain consistent security enforcement across different browser environments.
Features
- HTML Sanitization Utilities - Strips malicious code from untrusted HTML input to prevent cross-site scripting attacks in web applications.
- Input Sanitization - Removes malicious code and dangerous elements from input to prevent cross-site scripting while preserving safe content.
- Cross-Site Scripting Prevention - Provides robust sanitization and encoding techniques to prevent cross-site scripting and filter evasion attacks.
- DOM Security Utilities - Provides a secure utility for manipulating the document object model by filtering untrusted input.
- Trusted Types Policies - Integrates with browser-level Trusted Types to prevent the execution of unverified string-based code.
- Trusted Types Integrations - Integrates with browser security policies to ensure sanitized output is safely handled by sensitive document sinks.
- Safe Rich Text Renderers - Enables safe rendering of user-provided rich text by stripping dangerous elements.
- Trusted Types Polyfills - Ensures consistent security enforcement across browsers by polyfilling Trusted Types support.
- HTML Content Policies - Enforces strict content policies by limiting allowed HTML tags and attributes.
- DOM Security Policy Enforcers - Ensures dynamically generated content adheres to strict document object model safety standards.
- DOM-Tree Sanitizers - Uses native browser parsing to safely inspect and clean document fragments.
- HTML Allowlists - Provides granular control over permitted HTML elements and attributes to prevent malicious code injection.
- Vulnerability Scanners - XSS sanitizer for HTML, MathML, and SVG.
- Input Validation and Sanitization - Fast and tolerant XSS sanitizer for HTML and SVG.
- Security and Sanitization - Fast, robust XSS sanitizer for HTML and SVG.
- Security Middleware - Fast and secure DOM-only sanitizer for HTML, MathML, and SVG.
- Security & Privacy - Fast, high-tolerance XSS filter for HTML/SVG.
- Sanitization Contexts - Adapts sanitization logic dynamically to handle complex or nested HTML structures safely.
- Single-Pass Cleanup Engines - Performs efficient, side-effect-free sanitization on detached document fragments.
- Recursive Tree Traversers - Ensures deep inspection of document structures to neutralize nested malicious content.
