DOMPurify is a DOM-only XSS sanitizer for HTML, MathML and SVG that runs as JavaScript in web browsers and Node.js environments.
The tool addresses the problem of cross-site scripting attacks by sanitizing untrusted HTML, MathML, and SVG content before it reaches the DOM. It operates with a secure default configuration while allowing extensive customization through configuration options and hooks. The sanitizer is designed to be both performant and tolerant of malformed input, handling edge cases that arise from parser mutations, namespace tricks, clobbering attacks, and template injection vectors.
Developers should adopt this tool when they need to safely render user-supplied or third-party HTML content in web applications. It suits projects ranging from content management systems to rich text editors where HTML sanitization is critical. The tool works across modern browsers including Safari, Opera, Edge, Firefox, and Chrome, with graceful degradation on legacy browsers. A separate maintenance branch provides security updates for Internet Explorer compatibility where needed.
The project's maintainers respond to issues and pull requests within hours. Work in the issue tracker is dominated by enhancement requests, indicating active development focused on expanding capabilities and improving the sanitizer's robustness.
