Class: Sanitizer

Sanitizer(configopt)

Provides sanitization for values used in templates with configurable security policies.

Constructor

new Sanitizer(configopt)

Constructs the Sanitizer with configuration options.

Parameters:
Name Type Attributes Description
config object <optional>

Sanitization configuration policy.

Properties
Name Type Attributes Description
allowedTags Array:.<string:> | Set:.<string:> <optional>

Array or Set of allowed tag names.
disallowedTags Array:.<string:> | Set:.<string:> <optional>

Array or Set of explicitly forbidden tag names.
allowedAttributes Record:.<string:, Array:.<string:>> <optional>

Map of tag names to allowed attribute lists.
disallowedAttributes Record:.<string:, Array:.<string:>> | Array:.<string:> <optional>

Map or array of forbidden attributes.
stripComments boolean <optional>

Whether to strip HTML comment nodes.
stripContentTags Array:.<string:> | Set:.<string:> <optional>

Tags whose child content is discarded when stripped.
allowDataUrls boolean <optional>

Whether data: URLs are permitted for img tags.
voidTags Array:.<string:> <optional>

Additional custom void tag names.
Source:

Classes

Sanitizer

Methods

sanitize(value) → {string}

Sanitizes a value.

Parameters:
Name Type Description
value any

The value to sanitize.
Source:
Returns:

The sanitized string.

Type
string

(static) sanitizeUrl(url, allowedProtocolsopt) → {string}

Sanitizes a URL string, returning about:blank for disallowed protocols.

Protects applications that bind user-provided URLs to href/src attributes from javascript: and other pseudo-protocol XSS vectors.

Parameters:
Name Type Attributes Description
url string

The URL to sanitize.
allowedProtocols Array:.<string:> <optional>

Allowed protocols (including the trailing colon). Defaults to ['http:', 'https:', 'mailto:', 'tel:'].
Source:
Returns:

The trimmed URL when its protocol is allowed, or 'about:blank' for disallowed protocols and empty/whitespace input.

Type
string

(static) stripTags(html) → {string}

Strips all HTML markup, script/style element content, and HTML comments from a string, returning plain text.

Parameters:
Name Type Description
html string

The HTML string from which to strip tags.
Source:
Returns:

Plain text with all tags removed.

Type
string