cure53/DOMPurify
View on GitHub ↗ ★ 17,499 JavaScript
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
14 mentions on Hacker News by 14 people: 1 story, 13 comments · first 2015-10-19 · latest 2025-12-11
20082026
-
…approaches for defence in depth ¹ https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP ² https://github.com/cure53/DOMPurify
comment by lucgommans · 2025-12-11 · in An SVG is all you need -
…https://github.com/marijnh/find-cluster-break https://github.com/marijnh/w3c-keyname https://github.com/cure53/DOMPurify https://github.com/electron/electron https://github.com/electron/get https://github.com/debug-js/debug…
comment by CMay · 2025-09-20 · in Less is safer: Reducing the risk of supply chain attacks -
…user profiles) before rendering it to visitors. Some libraries for doing that with good defaults: - https://github.com/cure53/DOMPurify - https://github.com/apostrophecms/sanitize-html - https://github.com/bevacqua/insane (right now your…
comment by diggan · 2024-06-10 · in Show HN: Markdown HN profiles at {user}.at.hn -
…that article really shouldn't imply that sanitization is "that easy". It does at least mention https://github.com/cure53/DOMPurify at the end but it should LOUDLY argue against attempting to write this particular thing yourself and promote…
comment by simonw · 2023-11-06 · in Mastering DOM manipulation with vanilla JavaScript -
…DOMPurify [0], it helps much to simplify the messy JavaScript, HTML. Yin [1] has book on that. [0]: https://github.com/cure53/DOMPurify [1]: https://leanpub.com/react-wagtail
comment by babayega2 · 2022-11-23 · in Ask HN: Is it time for a new Storybook? -
…using DOMPurify over sanitize-html. It is a lot smaller in bundle size, it is also well maintained: https://github.com/cure53/DOMPurify The author mentions to build their own sanitizer, which I would recommend against. Maybe for this use…
comment by leipert · 2021-07-24 · in A contentEditable, pasted garbage and caret placement walk into a pub -
DomPurify by default allows style tags ( https://github.com/cure53/DOMPurify/blob/master/src/tags.js#... ) which can be used for tracking visits and some types of password extraction from certain types of frameworks (see…
comment by SahAssar · 2020-02-27 · in Don’t try to sanitize input – escape output -
> HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify ) Or use iframe.sandbox, which was designed for it. https://www.w3schools.com/tags/att_iframe_sandbox.asp
comment by lostmsu · 2019-06-26 · in Why is Stack Overflow trying to start audio? -
…1. Text based ads only (no third party js) 2. HTML based ads but no js (run it through DOMPurify https://github.com/cure53/DOMPurify ) 3. Look for a js sandbox -- this _will_ break arbitrary js, will not be supported in all browsers, and…
comment by rsj_hn · 2019-06-26 · in Why is Stack Overflow trying to start audio? -
…in 2016 unless you're sending Content-Type text/plain always try and use secure templates. https://github.com/cure53/DOMPurify is nice, but there are likely good options for your language. I say use secure templating because you need…
comment by tshadwell · 2016-03-30 · in The Basics of Web Application Security -
I think sanitizing email is a solved problem with this: https://github.com/cure53/DOMPurify I'm not the author but I've used it in the past. According to the readme it is what Fastmail uses.
comment by dugmartin · 2015-12-14 · in Email made me miserable, so I decided to build my own email app from scratch -
https://github.com/cure53/DOMPurify
comment by leeoniya · 2015-12-04 · in The Fall and Rise of SVG -
…for DOM clobbering so is currently bypassable with the right malicious content. I recommend using https://github.com/cure53/DOMPurify for this rather than writing your own. It's tricky to get all the edge cases right, so better to use…
comment by nmjenkins · 2015-10-19 · in Trix: A rich text editor for everyday writing