zmyvak

Simple HTML sanitizer that removes dangerous tags and attributes to prevent XSS attacks. It strips elements like <script>, <iframe>, <style>, and others, as well as event handler attributes (e.g. onclick, onmouseover) and attributes that can carry javascript: or vbscript: payloads.

Based on simple-sanitize-html

Install

$ npm install --save zmyvak

Usage

import sanitizeHTML from 'zmyvak';

// Plain text passes through unchanged
sanitizeHTML('Hello, world!');
// => 'Hello, world!'

// Safe tags and attributes are preserved
sanitizeHTML('<p class="intro">Hello, <strong>world</strong>!</p>');
// => '<p class="intro">Hello, <strong>world</strong>!</p>'

// Dangerous tags are removed entirely
sanitizeHTML('<div>safe content</div><script>alert("xss")</script>');
// => '<div>safe content</div>'

// Event handler attributes are stripped
sanitizeHTML('<a onmouseover="alert(document.cookie)">click me</a>');
// => '<a>click me</a>'

// javascript: URLs are removed from attributes
sanitizeHTML('<a href="javascript:alert(1)">click me</a>');
// => '<a>click me</a>'

// Custom bad tags and attributes can be provided
sanitizeHTML('<div>text</div><marquee>annoying</marquee>', {
  badTags: new Set(['MARQUEE'])
});
// => '<div>text</div>'

License

ICS © Damian Krzeminski