demo · v146

Policy comparator

Three sanitizer policies, one input, three live outputs. The default policy is what setHTML() gives you out of the box. The strict policy locks down to a tiny allowlist (text formatting only). The custom policy is yours: drop tags, allow tags, deny attributes, allow attributes, deny URL protocols. Paste the worst markup you can think of and watch each lane produce its sanitized result.

load an example

custom policy

default policy

strict policy

custom policy

0input bytes
0elements removed (default)
0attributes removed (default)
// 146 ships setHTML() + Sanitizer() on Element prototypes.
// Default policy is XSS-safe; you can override:
el.setHTML(input);                                  // default
el.setHTML(input, { sanitizer: { elements: ["p", "a"] } });  // strict
el.setHTML(input, { sanitizer: new Sanitizer(custom) });     // custom

see also