You should probably just use sanitize-html instead!
Node bindings for the Ammonia HTML sanitation library
Ammonia is a whitelist-based HTML sanitization library. It is designed to prevent cross-site scripting, layout breaking, and clickjacking caused by untrusted user-provided HTML being mixed into a larger web page.
Ammonia uses html5ever to parse and serialize document fragments the same way browsers do, so it is extremely resilient to syntactic obfuscation.
Ammonia parses its input exactly according to the HTML5 specification;
it will not linkify bare URLs, insert line or paragraph breaks, or convert (C)
into ©.
If you want that, use a markup processor before running the sanitizer.
- Add a compatibility layer to make ammonia-node a drop-in replacement for sanitize-html
With some very naive benchmarks, it looks like ammonia-node is a little faster than sanitize-html.
tool | time (less is better) |
---|---|
DOMPurify on JSDOM | 7565319ns |
sanitize-html | 677818ns |
ammonia w/ string | 499031ns |
ammonia w/ Buffer | 474540ns |
xss | 219687ns |
Thanks to the awesome people behind Ammonia for providing a fast HTML sanitizer library in rust.