js-xss
A JavaScript library that sanitizes untrusted HTML to prevent XSS attacks using a configurable whitelist.
What is js-xss?
js-xss is a robust HTML sanitization library designed to prevent Cross-Site Scripting (XSS) attacks by filtering user input. It allows developers to define a whitelist of allowed HTML tags and attributes, ensuring only safe content is rendered while maintaining flexibility for custom use cases.
Developers building web applications in Node.js or browser environments that need to safely render user-generated HTML content, such as forums, comment systems, or rich-text editors.
Developers choose js-xss for its strict whitelist-based security approach, high performance compared to alternatives, and extensive customization options through filter functions for tags, attributes, and CSS.
Overview
Sanitize untrusted HTML (to prevent XSS) with a configuration specified by a Whitelist
Use Cases
Best For
- Sanitizing user-generated HTML in Node.js applications like forums or CMS platforms.
- Preventing XSS attacks in browser-based applications that render dynamic content.
- Building custom HTML sanitization rules with fine-grained control over allowed tags and attributes.
- Filtering HTML in high-traffic applications where performance is critical.
- Safely allowing style attributes with integrated CSS filtering via the cssfilter module.
- Processing HTML from untrusted sources in command-line tools or batch operations.
Not Ideal For
- Projects needing out-of-the-box sanitization without any configuration or whitelist setup
- Applications requiring automatic sanitization of modern HTML5 elements or SVG without custom coding
- Teams without JavaScript expertise to implement and test custom filter functions
Pros & Cons
Pros
Benchmarks in the README show 22.53 MB/s throughput, significantly faster than alternatives like validator@0.3.7 at 6.9 MB/s, making it ideal for high-traffic applications.
Provides onTag, onTagAttr, onIgnoreTag, and other handlers, allowing fine-grained control over sanitization logic, as demonstrated in examples for allowing data-* attributes or custom tags.
Works in Node.js and browser environments with AMD, shim, and command-line tool support, enabling usage in diverse scenarios from servers to client-side rendering.
Optional CSS sanitization via the cssfilter module allows safe handling of style attributes with configurable whitelists, adding an extra layer of security.
Cons
Setting up custom whitelists and handler functions requires significant effort and security expertise, which can be error-prone and time-consuming for simple use cases.
CSS filtering relies on the separate cssfilter module, adding an extra dependency and potential integration overhead that isn't built-in.
The README does not fully detail the default whitelist (xss.whiteList), forcing developers to inspect source code or guess, potentially leading to security gaps.
Frequently Asked Questions
Related Projects
DOMPurifyDOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
sanitize-htmlClean up user-submitted HTML, preserving whitelisted elements and whitelisted attributes on a per-element basis. Built on htmlparser2 for speed and tolerance
AcraDatabase security suite. Database proxy with field-level encryption, search through encrypted data, SQL injections prevention, intrusion detection, honeypots. Supports client-side and proxy-side ("transparent") encryption. SQL, NoSQL.
xss-filtersSecure XSS Filters.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.