pitaj / ammonia-node

Node bindings for the Ammonia HTML sanitation library

You should probably just use sanitize-html instead!

ammonia-node

Node bindings for the Ammonia HTML sanitation library

Ammonia is a whitelist-based HTML sanitization library. It is designed to prevent cross-site scripting, layout breaking, and clickjacking caused by untrusted user-provided HTML being mixed into a larger web page.

Ammonia uses html5ever to parse and serialize document fragments the same way browsers do, so it is extremely resilient to syntactic obfuscation.

Ammonia parses its input exactly according to the HTML5 specification; it will not linkify bare URLs, insert line or paragraph breaks, or convert (C) into ©. If you want that, use a markup processor before running the sanitizer.

Not Really Todo

• Add a compatibility layer to make ammonia-node a drop-in replacement for sanitize-html

Benchmarks

With some very naive benchmarks, it looks like ammonia-node is a little faster than sanitize-html.

tool	time (less is better)
DOMPurify on JSDOM	7565319ns
sanitize-html	677818ns
ammonia w/ string	499031ns
ammonia w/ Buffer	474540ns
xss	219687ns

Thanks

Thanks to the awesome people behind Ammonia for providing a fast HTML sanitizer library in rust.