zanitize
v0.2.0
Published
Fast HTML+CSS sanitizer — Zig/Lexbor compiled to WASM
Downloads
24
Readme
zanitize
Fast HTML + CSS sanitizer compiled to WebAssembly from Zig + Lexbor.
- ~700 kB WASM binary
- DOM-aware — parses with a real HTML engine (Lexbor), not regexes
- Sanitizes
<style>elements and inlinestyle=""in one pass - Works in Node.js and the browser (no WASI runtime needed)
- 10–15× faster than JSDOM + DOMPurify
Install
npm install zanitizeUsage
Node.js
import { loadZanitize } from 'zanitize';
const zan = await loadZanitize(
new URL('./node_modules/zanitize/zanitize.wasm', import.meta.url)
);
zan.init(); // default config
console.log(zan.sanitizeFragment('<script>alert(1)</script><p>ok</p>'));
// => <p>ok</p>
console.log(zan.sanitize('<b onclick="bad()">hi</b>'));
// => <html><head></head><body><b>hi</b></body></html>Browser (Vite / webpack)
import { loadZanitize } from 'zanitize';
import wasmUrl from 'zanitize/zanitize.wasm?url'; // Vite
const zan = await loadZanitize(wasmUrl);
zan.init();
div.innerHTML = zan.sanitizeFragment(untrustedHtml);API
loadZanitize(wasmUrl)
Loads and compiles the WASM module. Call once at startup.
loadZanitize(wasmUrl: URL | string): Promise<ZanitizeInstance>zan.init(configJson?)
Initialises the sanitizer. Call before the first sanitize(). Safe to call again to reconfigure.
init(configJson?: string): booleanzan.init(); // safe defaults
zan.init('{"strictUriValidation": true}'); // strict URIs
zan.init(JSON.stringify({ removeElements: ['b'] })); // customzan.sanitizeFragment(html)
Sanitizes an HTML fragment. Returns the <body> content only — ready for innerHTML.
sanitizeFragment(html: string): string | nullzan.sanitize(html)
Sanitizes a full HTML string. Returns a complete <html>…</html> document.
sanitize(html: string): string | nullSanitizerConfig
Pass a JSON string to init(). Fields follow the W3C Sanitizer API:
zan.init(JSON.stringify({
removeElements: ['script', 'iframe', 'object'], // drop element + content
replaceWithChildrenElements: ['b', 'i'], // unwrap, keep children
removeAttributes: ['onclick', 'onerror'], // strip attributes
comments: false,
sanitizeDomClobbering: true, // protect window.* names
sanitizeInlineStyles: true, // sanitize style=""
strictUriValidation: false, // allow relative URLs
}));See the full config reference for all fields and presets.