HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
cure53
DOMPurify
JavaScript2015–2025
cure53 / DOMPurify

DOMPurify

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

Web DevelopmentSecurity & PrivacyCreative & MediaTesting & Quality
Explore on GitHubRead Hacker News discussions
14Distinct people
14Mentions
0Explicit recommenders
17.5KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:

GitHub

Where it is used

  • trix — Trix uses DOMPurify to sanitize the editor content. You can set the DOMPurify config via Trix.config.dompurify. Source

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 12:45:45 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by year14 dated mentions

Observed mentions: 2015-10-19 13:50:09 UTC to 2025-12-11 22:41:51 UTC.

01232015-01-01 00:00:00 UTC to 2016-01-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 comments20152016-01-01 00:00:00 UTC to 2017-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2017-01-01 00:00:00 UTC to 2018-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2018-01-01 00:00:00 UTC to 2019-01-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2019-01-01 00:00:00 UTC to 2020-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2020-01-01 00:00:00 UTC to 2021-01-01 00:00:00 UTC (exclusive): 2 mentions; 1 submissions, 1 comments20202021-01-01 00:00:00 UTC to 2022-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2022-01-01 00:00:00 UTC to 2023-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2023-01-01 00:00:00 UTC to 2024-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2024-01-01 00:00:00 UTC to 2025-01-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2025-01-01 00:00:00 UTC to 2026-01-01 00:00:00 UTC (exclusive): 2 mentions; 0 submissions, 2 comments2025

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
20152015-01-01 00:00:00 UTC2016-01-01 00:00:00 UTC303
20162016-01-01 00:00:00 UTC2017-01-01 00:00:00 UTC101
20172017-01-01 00:00:00 UTC2018-01-01 00:00:00 UTC000
20182018-01-01 00:00:00 UTC2019-01-01 00:00:00 UTC000
20192019-01-01 00:00:00 UTC2020-01-01 00:00:00 UTC202
20202020-01-01 00:00:00 UTC2021-01-01 00:00:00 UTC211
20212021-01-01 00:00:00 UTC2022-01-01 00:00:00 UTC101
20222022-01-01 00:00:00 UTC2023-01-01 00:00:00 UTC101
20232023-01-01 00:00:00 UTC2024-01-01 00:00:00 UTC101
20242024-01-01 00:00:00 UTC2025-01-01 00:00:00 UTC101
20252025-01-01 00:00:00 UTC2026-01-01 00:00:00 UTC202

What Hacker News says

2 sources
lucgommans·Dec 11, 2025
> would love to see more tooling to lint and sanitize them before deployment Sanitisation is one of two possible defences, the other being script execution controls or sandboxing. E.g., if you serve vector images on a web server, set a Content Security Policy header¹ for all your images that simply denies all scripting. You can also run it from a dummy domain ('origin') with nothing valuable on it (like how domains such as googleusercontent.com and githubusercontent.com are being used) For sanitisation, DOMPurify² is the only widely used and tested library that I know of. It could use more bindings for other languages but, if you can call into it, it can go in your deployment pipeline. (Disclosure: I've worked with some of the people at Cure53, but not on this project) You can also combine the approaches for defence in depth ¹ https://dev
Read the rest
eloper.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP ² https://github.com/cure53/DOMPurify
In An SVG is all you need
CMay·Sep 20, 2025
On the other hand, their actual dependency list looks closer to this, and this is definitely not comprehensive: https://github.com/ionic-team/capacitor https://github.com/Microsoft/tslib https://github.com/codemirror https://github.com/codemirror/autocomplete https://github.com/codemirror/language https://github.com/marijnh/style-mod https://github.com/marijnh/crelt https://github.com/marijnh/find-cluster-break https://github.com/marijnh/w3c-keyname https://github.com/cure53/DOMPurify https://github.com/electron/electron https://github.com/electron/get https://github.com/debug-js/debug https://github.com/vercel/ms https://github.com/sindresorhus/env-paths https://github.com/sindresorhus/got https://github.com/sindresorhus/is https://github.com/visionmedia/node-progress https://github.com/npm/node-semver https://github.com/malept/sumchecke
Read the rest
r https://github.com/szmarczak/http-timer https://github.com/szmarczak/defer-to-connect https://github.com/szmarczak/cacheable-lookup https://github.com/jaredwray/cacheable https://github.com/biomejs/biome https://github.com/sindresorhus/decompress-response https://github.com/sindresorhus/mimic-response https://github.com/octet-stream/form-data-encoder https://github.com/szmarczak/http2-wrapper https://github.com/szmarczak/resolve-alpn https://github.com/sindresorhus/lowercase-keys https://github.com/sindresorhus/p-cancelable https://github.com/sindresorhus/responselike https://github.com/sindresorhus/type-fest https://github.com/sindresorhus/tagged-tag https://github.com/max-mapper/extract-zip https://github.com/sindresorhus/get-stream https://github.com/Sec-ant/readable-stream https://github.com/sindresorhus/is-stream https://github.com/thejoshwolfe/yauzl https://github.com/brianloveswords/buffer-crc32 https://github.com/andrewrk/node-pend https://github.com/i18next/i18next https://github.com/babel/babel https://github.com/microsoft/TypeScript https://github.com/lezer-parser https://github.com/lucide-icons/lucide https://github.com/mathjax/MathJax https://github.com/mermaid-js/mermaid https://github.com/moment/moment https://github.com/mozilla/pdf.js https://github.com/pixijs/pixijs https://github.com/mapbox/earcut https://github.com/primus/eventemitter3 https://github.com/matt-way/gifuct-js https://github.com/matt-way/jsBinarySchemaParser https://github.com/kaimallea/isMobile https://github.com/browserslist/caniuse-lite https://github.com/jkroso/parse-svg-path https://github.com/avoidwork/tiny-lru https://github.com/PrismJS/prism/ https://github.com/mourner/rbush https://github.com/mourner/quickselect https://github.com/remarkjs/remark https://github.com/hakimel/reveal.js https://github.com/barrysteyn/node-scrypt https://github.com/nodejs/nan https://github.com/mixmark-io/turndown https://github.com/mixmark-io/domino https://github.com/webpack/webpack https://github.com/acornjs/acorn https://github.com/nicolo-ribaudo/acorn-import-phases https://github.com/browserslist/browserslist https://github.com/web-platform-dx/baseline-browser-mapping https://github.com/kilian/electron-to-chromium https://github.com/chicoxyzzy/node-releases https://github.com/browserslist/update-db https://github.com/lukeed/escalade https://github.com/alexeyraspopov/picocolors https://github.com/samccone/chrome-trace-event https://github.com/webpack/enhanced-resolve https://github.com/isaacs/node-graceful-fs https://github.com/webpack/tapable https://github.com/guybedford/es-module-lexer https://github.com/eslint/js https://github.com/browserify/events https://github.com/fitzgen/glob-to-regexp https://github.com/isaacs/node-graceful-fs https://github.com/npm/json-parse-even-better-errors https://github.com/webpack/loader-runner https://github.com/jshttp/mime-types https://github.com/jshttp/mime-db https://github.com/suguru03/neo-async https://github.com/webpack/schema-utils https://github.com/ajv-validator/ajv https://github.com/epoberezkin/fast-deep-equal https://github.com/fastify/fast-uri https://github.com/epoberezkin/json-schema-traverse https://github.com/floatdrop/require-from-string https://github.com/ajv-validator/ajv-formats https://github.com/ajv-validator/ajv-keywords https://github.com/DefinitelyTyped/DefinitelyTyped https://github.com/webpack-contrib/terser-webpack-plugin https://github.com/jridgewell/sourcemaps https://github.com/jestjs/jest https://github.com/yahoo/serialize-javascript https://github.com/browserify/randombytes https://github.com/terser/terser https://github.com/tj/commander.js https://github.com/evanw/node-source-map-support https://github.com/LinusU/buffer-from https://github.com/mozilla/source-map https://github.com/webpack/watchpack https://github.com/webpack/webpack-sources https://github.com/eemeli/yaml
In Less is safer: Reducing the risk of supply chain attacks

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.