SanitizeHTML

Description

SanitizeHTML.Sanitize(html) returns a copy of an HTML string with scripts, event-handler attributes (onerror, onclick), javascript: URLs and other cross-site scripting vectors removed. It is a wrapper around DOMPurify, which is bundled with Tesserae and always loaded, so there is no preload step and the call is synchronous.

Call it at every trust boundary: HTML from user input, a third-party API, AI-generated content or the clipboard, before it reaches the DOM. For Markdown, MarkdownBlock already sanitizes its output.

The wrapper takes only the HTML string and uses DOMPurify's default configuration. It exposes no DOMPurify options.

Usage

Sanitize once, then inject:

var safe = SanitizeHTML.Sanitize(untrustedHtml);
someElement.innerHTML = safe;

Live demo

Edit the HTML in the left box. The right box shows the sanitized string. The script tag, the onerror and onclick attributes and the javascript: URL are dropped.

API reference

class

SanitizeHTML

public static class SanitizeHTML

Static helpers around the globally-loaded DOMPurify library. DOMPurify is bundled with Tesserae and always loaded - no preload step is required.

Namespace
Tesserae

Methods

NameDescription
SanitizeReturns a DOMPurify-sanitized copy of the given html.
Method
SanitizeHTML.Sanitize
public static string Sanitize(string html)

Returns a DOMPurify-sanitized copy of the given html.

See also