Hacker GitHub

← All repos

cure53/DOMPurify

View on GitHub ↗ ★ 17,499 JavaScript

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

14 mentions on Hacker News by 14 people: 1 story, 13 comments · first 2015-10-19 · latest 2025-12-11

Mentions per year 14 mentions · busiest year 2015 (3)
20082026
AllStoriesComments NewestTopOldest
  1. …approaches for defence in depth ¹ https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP ² https://github.com/cure53/DOMPurify
    comment by lucgommans · 2025-12-11 · in An SVG is all you need
  2. …https://github.com/marijnh/find-cluster-break https://github.com/marijnh/w3c-keyname https://github.com/cure53/DOMPurify https://github.com/electron/electron https://github.com/electron/get https://github.com/debug-js/debug…
    comment by CMay · 2025-09-20 · in Less is safer: Reducing the risk of supply chain attacks
  3. …user profiles) before rendering it to visitors. Some libraries for doing that with good defaults: - https://github.com/cure53/DOMPurify - https://github.com/apostrophecms/sanitize-html - https://github.com/bevacqua/insane (right now your…
    comment by diggan · 2024-06-10 · in Show HN: Markdown HN profiles at {user}.at.hn
  4. …that article really shouldn't imply that sanitization is "that easy". It does at least mention https://github.com/cure53/DOMPurify at the end but it should LOUDLY argue against attempting to write this particular thing yourself and promote…
    comment by simonw · 2023-11-06 · in Mastering DOM manipulation with vanilla JavaScript
  5. …DOMPurify [0], it helps much to simplify the messy JavaScript, HTML. Yin [1] has book on that. [0]: https://github.com/cure53/DOMPurify [1]: https://leanpub.com/react-wagtail
    comment by babayega2 · 2022-11-23 · in Ask HN: Is it time for a new Storybook?
  6. …using DOMPurify over sanitize-html. It is a lot smaller in bundle size, it is also well maintained: https://github.com/cure53/DOMPurify The author mentions to build their own sanitizer, which I would recommend against. Maybe for this use…
    comment by leipert · 2021-07-24 · in A contentEditable, pasted garbage and caret placement walk into a pub
  7. ▲ 1
    One-liner fix for all your XSS woes in legacy web applications
    story by sbtmuller · 2020-04-14 · 0 comments
  8. DomPurify by default allows style tags ( https://github.com/cure53/DOMPurify/blob/master/src/tags.js#... ) which can be used for tracking visits and some types of password extraction from certain types of frameworks (see…
    comment by SahAssar · 2020-02-27 · in Don’t try to sanitize input – escape output
  9. > HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify ) Or use iframe.sandbox, which was designed for it. https://www.w3schools.com/tags/att_iframe_sandbox.asp
    comment by lostmsu · 2019-06-26 · in Why is Stack Overflow trying to start audio?
  10. …1. Text based ads only (no third party js) 2. HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify ) 3. Look for a js sandbox -- this _will_ break arbitrary js, will not be supported in all browsers, and…
    comment by rsj_hn · 2019-06-26 · in Why is Stack Overflow trying to start audio?
  11. …in 2016 unless you're sending Content-Type text/plain always try and use secure templates. https://github.com/cure53/DOMPurify is nice, but there are likely good options for your language. I say use secure templating because you need…
    comment by tshadwell · 2016-03-30 · in The Basics of Web Application Security
  12. I think sanitizing email is a solved problem with this: https://github.com/cure53/DOMPurify I'm not the author but I've used it in the past. According to the readme it is what Fastmail uses.
    comment by dugmartin · 2015-12-14 · in Email made me miserable, so I decided to build my own email app from scratch
  13. https://github.com/cure53/DOMPurify
    comment by leeoniya · 2015-12-04 · in The Fall and Rise of SVG
  14. …for DOM clobbering so is currently bypassable with the right malicious content. I recommend using https://github.com/cure53/DOMPurify for this rather than writing your own. It's tricky to get all the edge cases right, so better to use…
    comment by nmjenkins · 2015-10-19 · in Trix: A rich text editor for everyday writing