v146 · Security · JavaScript · demo
Comment Editor
A rich comment editor with a live preview powered by the Sanitizer API. Type or paste HTML — including XSS payloads — and the preview renders the safe output via element.setHTML(). A threat log tracks every removed element and attribute in real time.
Chrome 146+ — Sanitizer API (
new Sanitizer(), element.setHTML()). In older browsers the demo falls back to DOMParser with manual tag-stripping, which is less safe. The sanitizer is always the right tool for user-supplied HTML.
Type HTML in the editor · or load an XSS snippet · preview shows the sanitized output · threat log shows what was removed
Input (unsanitized HTML)
Preview (sanitized)
Removed by sanitizer
0 threats
No threats detected yet
// Sanitizer API — Chrome 146
// Safe HTML insertion via element.setHTML()
const sanitizer = new Sanitizer(); // default config strips script, events, etc.
// setHTML() is the safe equivalent of innerHTML =
commentPreview.setHTML(userInput); // never throws, always produces safe HTML
// Custom config: only allow bold, italic, links
const strict = new Sanitizer({
allowElements: ['b', 'i', 'a'],
allowAttributes: { 'a': ['href'] },
dropAttributes: { '*': ['style', 'class'] },
});
// No need for DOMPurify or manual regex — the browser does the right thing.