SanitizeHTML
Description
SanitizeHTML.Sanitize(html) returns a copy of an HTML string with scripts, event-handler attributes (onerror, onclick), javascript: URLs and other cross-site scripting vectors removed. It is a wrapper around DOMPurify, which is bundled with Tesserae and always loaded, so there is no preload step and the call is synchronous.
Call it at every trust boundary: HTML from user input, a third-party API, AI-generated content or the clipboard, before it reaches the DOM. For Markdown, MarkdownBlock already sanitizes its output.
The wrapper takes only the HTML string and uses DOMPurify's default configuration. It exposes no DOMPurify options.
Usage
Sanitize once, then inject:
var safe = SanitizeHTML.Sanitize(untrustedHtml);
someElement.innerHTML = safe;
Live demo
Edit the HTML in the left box. The right box shows the sanitized string. The script tag, the onerror and onclick attributes and the javascript: URL are dropped.
API reference
public static class SanitizeHTMLStatic helpers around the globally-loaded DOMPurify library. DOMPurify is bundled with Tesserae and always loaded - no preload step is required.
- Namespace
- Tesserae
Methods
| Name | Description |
|---|---|
| Sanitize | Returns a DOMPurify-sanitized copy of the given html. |