npm package discovery and stats viewer.

Discover Tips

  • General search

    [free text search, go nuts!]

  • Package details

    pkg:[package-name]

  • User packages

    @[username]

Sponsor

Optimize Toolset

I’ve always been into building performant and accessible sites, but lately I’ve been taking it extremely seriously. So much so that I’ve been building a tool to help me optimize and monitor the sites that I build to make sure that I’m making an attempt to offer the best experience to those who visit them. If you’re into performant, accessible and SEO friendly sites, you might like it too! You can check it out at Optimize Toolset.

About

Hi, 👋, I’m Ryan Hefner  and I built this site for me, and you! The goal of this site was to provide an easy way for me to check the stats on my npm packages, both for prioritizing issues and updates, and to give me a little kick in the pants to keep up on stuff.

As I was building it, I realized that I was actually using the tool to build the tool, and figured I might as well put this out there and hopefully others will find it to be a fast and useful way to search and browse npm packages as I have.

If you’re interested in other things I’m working on, follow me on Twitter or check out the open source projects I’ve been publishing on GitHub.

I am also working on a Twitter bot for this site to tweet the most popular, newest, random packages from npm. Please follow that account now and it will start sending out packages soon–ish.

Open Software & Tools

This site wouldn’t be possible without the immense generosity and tireless efforts from the people who make contributions to the world and share their work via open source initiatives. Thank you 🙏

© 2024 – Pkg Stats / Ryan Hefner

@aegisjsproject/sanitizer

v0.1.3

Published

A polyfill for the Sanitizer API with various sanitizer configs

Downloads

814

Readme

@aegisjsproject/sanitizer

Sanitizer API polyfill & config

CodeQL Node CI Lint Code Base

GitHub license GitHub last commit GitHub release GitHub Sponsors

npm node-current npm bundle size gzipped npm

GitHub followers GitHub forks GitHub stars Twitter Follow

Donate using Liberapay


AegisJSProject Sanitizer

This is a library & polyfill for the Sanitizer API.

It provides a minimal polyfill for Element.prototype.setHTML() & Document.parseHTML(), as well as config files for HTML, SVG, & MathML. Please note, however, that the default sanitizer config in these sanitizer methods only support HTML by default.

The "base" config (not what is used by default) DOES add support for <svg>, and the "complete" config supports <svg> & <math>.

This helps prevent XSS via:

  • Stripping event attributes such as onclick
  • Removing unsafe URL attributes such a <a href="javascript:...">
  • Prevents adding <script>s and <style>s
  • Removes other potentially dangerous elements & attributes

Example

import '@aegijsproject/sanitizer/polyfill.js';
import { sanitizer } from '@aegisjsproject/sanitizer/config/base.js';

document.body.setHTML(`
  <header id="header">
    <h1 onclick="alert(location.href)" data-foo="bar">Hello, World!</h1>
  </header>
  <nav id="nav" class="flex row">
    <button type="button" popovertarget="bacon" popovertargetaction="show" accesskey="b">Show Bacon Ipsum</button>
    <a href="#foo">Normal Link</a>
    <a href="javascript:alert('javascript:')"><code>javascript:</code> Link</a>
    <a href="data:text/plain,Not%20Allowed" target="_blank"><code>data:</code> Link</a>
    <a href="${URL.createObjectURL(file)}" target="_blank"><code>blob:</code> Link</a>
  </nav>
  <main id="main"></main>
  <div popover="auto" id="bacon">
    <div>
      <b>Bacon Ipsum</b>
      <button type="button" popovertarget="bacon" popovertargetaction="hide">
        <svg xmlns="http://www.w3.org/2000/svg" width="12" height="16" viewBox="0 0 12 16" fill="currentColor" role="presentation" aria-label="Close Popover">
          <path fill-rule="evenodd" d="M7.48 8l3.75 3.75-1.48 1.48L6 9.48l-3.75 3.75-1.48-1.48L4.52 8 .77 4.25l1.48-1.48L6 6.52l3.75-3.75 1.48 1.48L7.48 8z"/>
        </svg>
      </button>
    </div>
    <p>Bacon ipsum dolor amet pork belly frankfurter drumstick jowl brisket capicola
      short ribs.Cow chislic ham hock t-bone shoulder salami rump corned beef spare
      ribs prosciutto bresaola picanha drumstick. Swine tail pork belly ribeye beef
      kielbasa. Beef cupim ball tip pastrami spare ribs strip steak tongue salam
      venison. Venison cupim meatball strip steak meatloaf prosciutto buffalo
      frankfurter hamburger flank boudin.</p>
  </div>
`, sanitizer);

Restricting Allowed Content (eg for comments)

const sanitizer = {
  elements: ['span', 'div', 'p', 'code', 'pre', 'blockquote', 'img', 'a'],
  attributes: ['href', 'src', 'loading', 'height', 'width', 'class', 'alt', 'target'],
};

fetch('https://api.example.com/comments')
  .then(resp => resp.json())
  .then(comments => {
    document.querySelector('.comments').append(...comments.map(comment => {
      const el = document.createElement('div');
      el.setHTML(comment.body, sanitizer);
      return el;
    }));
  });

Adding to allowed elements / attributes

import { elements, attributes } from '@aegisjsproject/sanitizer/config/html.js';

const sanitizer = {
  elements: ['hello-world', ...elements],
  attributes: ['foo', ...attributes],
};

document.querySelector('.container').setHTML(`
  <hello-world foo="bar"></hello-world>
`, sanitizer);

Enforce Sanitization by default (on eg innerHTML, where supported)

if ('trustedTypes' in globalThis) {
  trustedTypes.createPolicy('default', {
    createHTML(input) {
      const el = document.createElement('div');
      el.setHTML(input);
      return el.innerHTML;
    }
  });
}