XssKillah (Work in Progress)

A Fast Minimal DOM-based HTML Sanitizer

XssKillah is a lightweight and fast HTML sanitizer designed for securing components and content delivery. While it comes with opinionated defaults for high protection, it offers flexibility for various real-world use cases.

Features

• 2.11KB minified | 957 bytes (brotli)
• Minimal allowed markup by default for enhanced security
• Fast (Outperforms generic sanitizers like DomPurify and Sanitize-HTML)
• Sanitizes against a real DOM (not RegEx)
• Cleans dangerous URLs
• No need for escaping (Textual content is encapsulated in Text-nodes)
• Whitelist opt-in for dangerous tags, attributes, and known vulnerable combinations

Philosophy

XssKillah follows a highly opinionated approach by disallowing as many vulnerable tags and attributes as possible. This minimalistic design keeps XssKillah small, ensuring fast performance. It offers clarity, allowing you to understand the risks as you enable specific features.

Restrictions

In theory, there are no restrictions on what can be rendered. XssKillah is an opt-in sanitizer, meaning that rendered script tags will not execute unless explicitly allowed.

API

The API details are still a work in progress and will be announced soon.

License

MIT © Julien Etienne 2024