sanitize-html

sanitize-html cleans up user-submitted or otherwise untrusted HTML by keeping only an allowlist of tags and per-tag attributes and discarding everything else. Built on the htmlparser2 streaming parser, it is tolerant of messy input, making it well suited to the fragments produced by rich-text editors like CKEditor and TinyMCE or pasted from Word.

Beyond simple tag filtering, it validates href and src URL schemes, filters iframe hostnames, sanitizes inline styles with PostCSS, escapes all text content, and lets you transform tags on the fly. The result is a small, dependency-light module that gives you fine-grained, server-side control over which HTML is safe to store and render.

What You Get

• A single sanitizeHtml(dirty, options) function that returns cleaned HTML
• A configurable per-tag allowlist for tags, attributes, classes, and URL schemes
• Inline CSS sanitization via PostCSS and iframe hostname filtering
• transformTags, exclusiveFilter, and textFilter hooks for custom rewriting
• A sensible default option set covering common rich-text markup

Common Use Cases

• Sanitizing rich-text editor output before persisting it to a database
• Cleaning pasted-from-Word markup by stripping unwanted inline styles and tags
• Rendering user-generated comments or posts without exposing an XSS surface
• Whitelisting a narrow set of formatting tags for constrained content fields

Under The Hood

Architecture - The entire library is a single ~1,000-line index.js exporting one function, sanitizeHtml. It drives htmlparser2 with onopentag, ontext, onclosetag, and oncomment handlers, maintaining a stack of open tags so it can decide whether each node and its text are kept, escaped, or discarded (tracking depth for discard modes). URL attributes flow through naughtyHref checks, srcset through parse-srcset, and inline styles through a PostCSS AST pass before being reserialized.

Tech Stack - Pure CommonJS JavaScript targeting Node 22+, with a small dependency set: htmlparser2 for parsing, postcss for style sanitization, deepmerge and is-plain-object for option merging, escape-string-regexp, parse-srcset, and launder for href laundering. No build step or transpilation is involved; the published package is just index.js.

Code Quality - The code favors small pure helpers (each, has, filter, isEmptyObject) and defensive guards against prototype-pollution vectors like proto. It is backed by an extensive Mocha suite of roughly 240 test cases in a 2,400-line test file exercising allowlists, URL validation, style filtering, and known XSS payloads, plus ESLint via eslint-config-apostrophe.

API Design - The public surface is deliberately minimal: sanitizeHtml(dirty, options). A well-documented default option set gets developers productive immediately, while allowedTags, allowedAttributes, allowedSchemes, transformTags, exclusiveFilter, and textFilter provide progressively deeper control. The README is thorough with copy-paste examples, keeping the learning curve gentle for the common case.