js-xss is a whitelist-based HTML sanitizer that prevents XSS attacks by filtering untrusted user input.
The tool addresses the problem of malicious scripts injected through user-supplied HTML by maintaining a whitelist of allowed tags and attributes. When HTML is passed through the sanitizer, any tags or attributes not on the whitelist are removed or escaped. The approach is configurable, allowing developers to define exactly which HTML elements and their attributes should be preserved, and to provide custom handler functions for tags and attributes that fall outside the whitelist.
Developers should choose this tool when building applications that accept user-generated HTML content and need to prevent XSS vulnerabilities. It suits projects ranging from discussion forums and content management systems to collaborative platforms. The tool works in both Node.js and browser environments, with command-line utilities available for batch processing files. It provides methods to retrieve both sanitized output and a list of removed elements, which can be useful for logging or user feedback. Custom filtering rules allow fine-grained control over which HTML constructs are permitted, with separate handler functions for whitelisted tags, non-whitelisted tags, and their respective attributes.
The project maintains active development with regular updates addressing edge cases and security concerns. The codebase includes comprehensive test coverage and benchmarking utilities to validate performance and correctness. Documentation is available in multiple languages, and the tool includes an interactive online sandbox for testing sanitization behavior. The project has been adopted by established applications in production environments, indicating stability and real-world reliability.
