sanitize-html

To prevent javascript: URI attacks, the library validates schemes for attributes like href, src, and cite.

• allowedSchemes: An array of permitted protocols (e.g., ['http', 'https', 'mailto']).
• allowedSchemesByTag: An object allowing different schemes for different tags.
• allowProtocolRelative: Boolean. If true, allows URLs starting with //.
• allowedScriptHostnames / allowedScriptDomains: If provided, restricts script[src] to specific hosts or domains.

When parseStyleAttributes is set to true (default), the library uses postcss to parse and filter inline style attributes. This prevents XSS via malicious CSS.

• parseStyleAttributes: Boolean. Enables/disables CSS parsing.
• allowedStyles: An object defining permitted CSS properties. Keys are property names (e.g., color), and values are arrays of RegExp objects or strings to validate the property value.

Note: Style parsing requires a Node.js environment due to the postcss dependency and may not work in browsers.

Use the allowedTags and allowedAttributes options to define a whitelist of permitted HTML elements and their attributes.

• allowedTags: An array of strings (e.g., ['p', 'em', 'strong']) or false to allow all tags.
• allowedAttributes: An object where keys are tag names and values are arrays of permitted attribute names (e.g., { 'a': ['href', 'title'] }). You can use '*' as a key to apply attributes to all allowed tags.
• nonTextTags: An array of tags (like script or style) whose content should be discarded if the tag itself is disallowed.

The sanitizeHtml function is the primary API for cleaning HTML strings. It parses the input and removes tags and attributes not explicitly allowed in the options object.

Key behaviors:

• If html is null, it returns an empty string.
• If html is a number, it is converted to a string.
• It uses a whitelist approach: only tags and attributes defined in the options (or defaults) are preserved.
• It handles different modes for disallowed tags via disallowedTagsMode (discard, completelyDiscard, escape, or recursiveEscape).

The transformTags option allows you to programmatically change a tag name or its attributes during the sanitization process.

• transformTags: An object where keys are the original tag names and values are either a function (tagName, attribs) => { tagName, attribs } or a string used with sanitizeHtml.simpleTransform.
• You can use '*' as a key to apply a transformation to all tags.

sanitizeHtml.simpleTransform(newTagName, newAttribs, [merge]) is a helper to create a transformation function that replaces a tag with a specific new tag and set of attributes.

sanitizeHtml.simpleTransform(newTagName, newAttribs, merge) returns a function used within the transformTags option.

• newTagName: The name of the tag to replace the original with.
• newAttribs: An object containing the attributes to apply to the new tag.
• merge: (Optional) Boolean. If true (default), the new attributes are merged into the existing ones. If false, the existing attributes are replaced by newAttribs.