@wuyuchentr/html-sanitize-lite

Lightweight HTML sanitizer — prevents XSS by keeping only safe tags and attributes. < 2 KB, no dependencies.

Install

npm install @wuyuchentr/html-sanitize-lite

Usage

const { sanitize } = require('@wuyuchentr/html-sanitize-lite');

sanitize('<p>Hello <b>world</b></p>');
// → '<p>Hello <b>world</b></p>'

sanitize('<script>alert("xss")</script><p>safe</p>');
// → '<p>safe</p>'

sanitize('<a href="javascript:alert(1)">click</a>');
// → '<a>click</a>'

sanitize('<img src=x onerror=alert(1)>');
// → '<img src="x">'

What's kept

Safe tags: a, p, b, i, em, strong, ul, ol, li, h1–h6, pre, code, blockquote, table, tr, td, th, img, span, div, br, hr, and ~40 more.

Safe attributes: href, src, title, alt, class, id, style, target, rel, width, height, colspan, rowspan, and ~90 more.

What's stripped

• Dangerous tags: script, style, iframe, object, embed, form, input, textarea, button, canvas, frame, link, meta, etc. — removed with their content.
• Event handlers: all on* attributes (onclick, onerror, onload, ...)
• Dangerous URLs: javascript:, data:, vbscript: in href/src
• Unknown tags are removed (their text content is kept)

API

sanitize(dirtyHtml) → string

Returns clean HTML. Simple.

Size comparison

| Library | Size | |---------|------| | DOMPurify | ~25 KB | | this | ~2 KB |