html-sanitizer

A Laravel wrapper for HTMLPurifier by ezyang

😾 Lean and configurable whitelist-oriented HTML sanitizer

HTML5 support for HTMLPurifier

It's a nginx http module to sanitize HTML5 with whitelisted elements, whitelisted attributes and whitelisted CSS property

Inofficial port of https://web.archive.org/web/20180126072328/http://wpl.codeplex.com/ to .NET Standard 2.0

Ports of remark and rehype plugins to Sätteri, the Rust markdown engine behind Astro 7.

A Nuxt 3 module for sanitizing HTML content using DOMPurify to protect against XSS attacks.

DOMPurify-powered HTML sanitizer for Svelte — SSR-safe, browser-ready, TypeScript-first.

The smallest and fastest DOM sanitizer based on browser native DOMParser

PHP extension that sanitizes untrusted HTML with ammonia. PHP 8.2–8.5 on macOS, Linux, and Windows.

DOMPurify without jsdom. Byte-identical output to DOMPurify on jsdom, about 65 KB gzipped, runs on Cloudflare Workers and other edge runtimes.

Zero-dependency strip-to-text HTML sanitizer with contextual output encoding for Node.js, browsers, and edge runtimes.

Graphql html sanitizing directive and scalar type

Sanitize untrusted HTML (READMEs, user content) — strip scripts, event handlers and Alpine x-* via a Symfony-backed allowlist.

Front-end math editor created as a test project. Allow to create custom katex expressions and use additional tags such as <b> and <i>.

Full-stack notes web app — React + TypeScript SPA with a React Context + useReducer state engine and an MVC Express/Mongoose REST API, plus an XSS security lab (custom HTML sanitizer, keylogger demo & attacker server).

Reader-friendly Cloudflare Worker for safer, cleaner web reading.

Spring Boot Starter For Shiro With OWASP Java HTML Sanitizer

Type-safe ESM server framework for Node 24+. The same routes run on AWS Lambda (API Gateway HTTP API v2) and a plain Node HTTP server, with WebSockets, middleware, routing and HTML sanitization built in.

CSS injection security testing toolkit: sanitizer capability fingerprinting, CSS attribute-selector exfiltration, and UI redress. Authorized engagements only.