DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
18 matches across 4 categories. Click a row to expand file-level details.
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | README.md | 261 | |
| LOW | test/test-suite.js | 3241 | } |
| LOW | test/test-suite.js | 3441 | '<svg></svg>', |
| LOW | test/test-suite.js | 3841 | assert.equal( |
| LOW | test/test-suite.js | 3961 | // |
| LOW | test/test-suite.js | 4161 | assert.equal(triggered, false, 'no XSS on native insertion'); |
| LOW | test/test-suite.js | 4441 | // an attack surface. childNodes / nodeType / shadowRoot etc. can be |
| LOW | test/test-suite.js | 4641 | // 1. Engine behaviour: not every name is clobberable via |
| LOW | test/fuzz/sanitize.fast-check.js | 261 | verbose: true, |
| LOW | test/fuzz/sanitize.fast-check.js | 341 | verbose: true, |
| LOW | .github/workflows/codeql-analysis.yml | 61 | |
| LOW | .github/workflows/build-and-test-skip.yml | 1 | name: Build & Test |
| LOW | src/purify.ts | 1221 | element.attributes !== getAttributes(element) || |
| LOW | src/purify.ts | 1861 | // Realm-safe check (GHSA-hpcv-96wg-7vj8): use nodeType-based |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | .github/dependabot.yml | 61 | # --------------------------------------------------------------------- |
| MEDIUM | .github/dependabot.yml | 70 | # --------------------------------------------------------------------- |
| Severity | File | Line | Snippet |
|---|---|---|---|
| MEDIUM | test/test-suite.js | 4654 | // failed on some engine. The robust pattern is to ask the |
| Severity | File | Line | Snippet |
|---|---|---|---|
| LOW | test/bootstrap-test-suite.js | 50 | function loadDOMPurifyWithSanityCheck( |