A JavaScript library that sanitizes untrusted HTML to prevent XSS attacks using a configurable whitelist.
js-xss is a robust HTML sanitization library designed to prevent Cross-Site Scripting (XSS) attacks by filtering user input. It allows developers to define a whitelist of allowed HTML tags and attributes, ensuring only safe content is rendered while maintaining flexibility for custom use cases.
Developers building web applications in Node.js or browser environments that need to safely render user-generated HTML content, such as forums, comment systems, or rich-text editors.
Developers choose js-xss for its strict whitelist-based security approach, high performance compared to alternatives, and extensive customization options through filter functions for tags, attributes, and CSS.
Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Benchmarks in the README show 22.53 MB/s throughput, significantly faster than alternatives like validator@0.3.7 at 6.9 MB/s, making it ideal for high-traffic applications.
Provides onTag, onTagAttr, onIgnoreTag, and other handlers, allowing fine-grained control over sanitization logic, as demonstrated in examples for allowing data-* attributes or custom tags.
Works in Node.js and browser environments with AMD, shim, and command-line tool support, enabling usage in diverse scenarios from servers to client-side rendering.
Optional CSS sanitization via the cssfilter module allows safe handling of style attributes with configurable whitelists, adding an extra layer of security.
Setting up custom whitelists and handler functions requires significant effort and security expertise, which can be error-prone and time-consuming for simple use cases.
CSS filtering relies on the separate cssfilter module, adding an extra dependency and potential integration overhead that isn't built-in.
The README does not fully detail the default whitelist (xss.whiteList), forcing developers to inspect source code or guess, potentially leading to security gaps.