DOMPurify

DOMPurify is a battle-tested XSS sanitizer that cleans untrusted HTML, MathML, and SVG markup before it touches the DOM. Built and maintained by the Cure53 security team since 2014, it works directly with the browser’s own DOM APIs rather than a hand-rolled parser, which keeps it fast and keeps its behavior aligned with how browsers actually render markup.

It ships as a single dependency-free function, DOMPurify.sanitize(dirty), that returns clean HTML, with a rich configuration surface for allow-listing tags and attributes, enforcing Trusted Types, and hooking into every stage of the sanitization pipeline. It runs in every modern browser and on the server via jsdom, and is the reference implementation that inspired the browser-native HTML Sanitizer API.

What You Get

• A single sanitize() function that accepts a dirty HTML/SVG/MathML string (or DOM node) and returns clean output
• Configurable allow-lists for tags, attributes, and URI schemes via ALLOWED_TAGS, ALLOWED_ATTR, and related config keys
• Built-in Trusted Types policy support for browsers that enforce them
• A hook system (beforeSanitizeElements, uponSanitizeAttribute, afterSanitizeAttributes, etc.) for customizing sanitization at every stage
• Server-side support via jsdom for sanitizing HTML in Node.js

Common Use Cases

• Sanitizing user-generated HTML (comments, rich-text editor output, markdown-rendered content) before rendering with innerHTML
• Cleaning HTML pulled from third-party APIs or CMS content before displaying it
• Sanitizing SVG uploads to strip embedded scripts and event handlers
• Enforcing Trusted Types policies in CSP-hardened web applications

Under The Hood

Architecture DOMPurify’s core sanitize() function (src/purify.ts, ~2,900 lines) builds a DOM tree from the input using the browser’s own DOMParser (or an injected WindowLike for server-side jsdom use), then walks that tree node-by-node, checking each element and attribute against allow-lists (ALLOWED_TAGS in src/tags.ts, ALLOWED_ATTR in src/attrs.ts) and regex-based URI/attribute validators (src/regexp.ts), removing or neutralizing anything unsafe before serializing the cleaned tree back to a string, or returning the DOM node/fragment directly when RETURN_DOM or RETURN_DOM_FRAGMENT is set. A hook system threaded through every phase (beforeSanitizeElements, uponSanitizeElement, uponSanitizeAttribute, afterSanitizeAttributes) lets callers intercept individual decisions, and a factory function (createDOMPurify) parameterizes the whole module over a WindowLike so the same code path runs against a real browser window or an injected jsdom window.

Tech Stack Written in TypeScript, compiled with Babel and bundled via Rollup into CJS, ESM, and UMD builds (dist/purify.cjs.js, dist/purify.es.mjs, dist/purify.js) plus a terser-minified production build, with zero runtime dependencies and only an optional @types/trusted-types dev dependency for Trusted Types typings. Testing spans QUnit-based unit tests (test/test-suite.js, 300+ assertions) run under both jsdom and happy-dom node runners, Playwright-driven cross-browser tests across Chromium/Firefox/WebKit including legacy engine snapshots, and property-based fuzz testing via fast-check (test/fuzz/sanitize.fast-check.js).

Code Quality Linting is enforced via xo (an ESLint preset) with Prettier formatting and a pre-commit husky hook. The codebase favors small pure helper functions (src/utils.ts) that wrap native Array/String/RegExp methods defensively, guarding against prototype pollution and monkey-patched globals — a pattern typical of security-critical libraries where correctness failures are security failures. A dedicated typescript/verify.js script installs the package fresh and type-checks consumer code against the shipped .d.ts files, catching type-definition regressions before release.

API Design The public surface is deliberately minimal: DOMPurify.sanitize(dirty, config?) is the only call most consumers need, returning a string by default or a DOM node/fragment when configured. Configuration keys (ALLOWED_TAGS, ALLOWED_ATTR, ADD_TAGS, FORBID_TAGS, SAFE_FOR_TEMPLATES, etc.) are consistently named and documented inline with TSDoc comments in src/config.ts, and the hook API exposes a fixed vocabulary of named hook points rather than free-form events. Getting started requires no setup for browser use (script tag or import DOMPurify from 'dompurify' plus one function call); server-side use requires only injecting a jsdom window, documented in the README with copy-pasteable CJS and ESM examples.