isomorphic-dompurify
    TypeScript icon, indicating that this package has built-in type declarations

    0.18.0 • Public • Published

    Isomorphic DOMPurify

    npm version Build Status Bundlephobia Minified Size

    The library makes it possible to seamlessly use DOMPurify on server and client in the same way. It does nothing by itself except providing an isomorthic/universal wrapper around DOMPurify, so all credits go to DOMPurify authors and contributors.

    DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks.

    Motivation

    DOMPurify needs a DOM tree to base on, which is not available in Node by default. To work on the server side, we need a fake DOM to be created and supplied to DOMPurify. It means that DOMPurify initialization logic on server is not the same as on client.

    This project was born with the idea of encapsulating DOMPurify initilization details and providing an easy way to import the library on both, server and client, for example in Next.js apps.

    It was inspired by Isomorphic Unfetch.

    Installation

    $ npm i isomorphic-dompurify
    

    Updates

    Please note that DOMPurify library doesn't follow Semantic Versioning, so we have to release every change as a minor version because we cannot be 100% sure whether new features are added to patch DOMPurify releases or not.

    Usage

    1. Import the library:
    // Import as an ES6 module.
    import DOMPurify from 'isomorphic-dompurify';
    
    // Or as a CommonJS module.
    const DOMPurify = require('isomorphic-dompurify');
    1. Sanitize a string:
    var clean = DOMPurify.sanitize(dirty);

    Supported Environments

    The library is aimed to work everywhere and has been tested in the following environments:

    • Node.js, CommonJS (automatically & manually)
    • Node.js, Webpack, ES6 (manually)
    • React.js without SSR (manually)
    • Next.js without SSR (manually)
    • Next.js with SSR (manually)

    Known Issues

    1. Can't resolve 'canvas' on Next.js serverless app
    2. Starting from 0.16.0, there is a dependency conflict which causes ReferenceError: TextEncoder is not defined

    License

    DOMPurify - Apache 2.0 or MPL 2.0 © 2015 Mario Heiderich

    Isomorphic DOMPurify - MIT License © 2020 Konstantin Komelin and contributors

    Install

    npm i isomorphic-dompurify

    DownloadsWeekly Downloads

    106,525

    Version

    0.18.0

    License

    MIT

    Unpacked Size

    5.7 kB

    Total Files

    6

    Last publish

    Collaborators

    • kkomelin