Nano Purify

JS library to remove all dangerous HTML tags to prevent XSS attacks.

• Small. From 326 to 613 bytes (minified and brotlied). DOMPurify takes 7 KB in JS bundle.
• TypeScript support out-of-the-box.
• It uses browser’s DOMParser for better performance. You need to use jsdom for Node.js.

import { sanitize, SAFE_TAGS } from 'nanopurify'

sanitize('<script>alert(1)</script> <b>Safe</b> Text', SAFE_TAGS)
//=> ' <b>Safe</b> Text'

sanitize('<b>Safe</b> Text')
//=> ' Text'

This project is based on DOMPurify by Cure53 with features reduction, API refactoring and code cleaning for smaller JS bundle footprint. Use DOMPurify if you need MathML, SVG, forms or any advanced features.

  Made in Evil Martians, product consulting for developer tools.

Install

npm install nanopurify

Usage

You can change list of safe tags:

sanitize(html, {
  // Allow-list of tags
  a: {
    // Allow-list of attributes for this tag
    href: /^(https?|mailto|tel):/,
  },
  '*': {
    // Allow-list of attributes for all tags
    title: true
  }
})

It uses browser’s DOMParser. For Node.js you will need to use jsdom:

import { JSDOM } from 'jsdom'

const window = new JSDOM().window

sanitize(html, SAFE_TAGS, window)