[Replacement]: neosanitize

[PuruVJ]

Package to replace

sanitize-html

Suggested replacement(s)

neosanitize package. By default, we suggest neosanitize/legacy as drop-in, and neosanitize with the prebuilt whatwg/parse5/htmlparser for more secure/correct as the correct path

Manifest type

preferred (lighter or more modern alternative package)

Rationale

sanitize-html ships entirity of postcss and other libraries just for very simple parsing at many places. neosanitize/legacy is a no-dep drop-in replacement passing all the tests of sanitize-html, and the relevant test suites of the upstream deps.

neosanitize itself comes by default a very fast WHATWG-parser, which is swappable with parse5, htmlparser2 as well

Availability

No response

Code example (optional)

[ghostdevv]

What's the difference/benefits when compared to dompurify? Also this doesn't reach the download threshold count of 10,000 but I'm not super against it anyway

[PuruVJ]

I was writing an answer then realized it should be in the repo/docs, so here it is: https://github.com/PuruVJ/neosanitize/blob/main/why-not-dompurify.md

TLDR: DOMPurify's great in the browser, but on the server it needs jsdom (heavy, leaks, won't run on the edge, and becomes part of your attack surface). neosanitize is zero-dependency, runs identically everywhere, and drops into sanitize-html with a one-line import change.

[dreyfus92]

hey @PuruVJ, thanks for taking the time on this one 🙏

another option worth putting on the table is ultrahtml which is zero deps and has a sanitize transformer built in.

[PuruVJ]

ultrahtml's a nice library, but it's a build-time HTML transform tool, not a security sanitizer, its sanitize is one transformer based on the withdrawn 2022 Sanitizer API draft. Three things: (1) it's not a sanitize-html drop-in — different API, you'd rewrite your whole config, whereas neosanitize/legacy is a one-line import swap; (2) it uses a tiny fault-tolerant parser, not a WHATWG one: no SVG/MathML namespace handling, which is exactly where mutation-XSS hides; a sanitizer that doesn't parse like the browser can be fed markup the browser later reinterprets. neosanitize verifies its parser against html5lib + the native DOMParser for that reason; (3) it's allow-list with no inviolable baseline, so protection rides on your attribute config. neosanitize is deny-by-default and an allow-list can never re-add on* or javascript:. Both are good, ultrahtml for rewriting HTML at build time, neosanitize for sanitizing untrusted input.