Use DOMPurify on server and client in the same way
Installations
npm install isomorphic-dompurifyDeveloper Guide
Typescript
Yes
Module System
CommonJS, UMD
Min. Node Version
>=18
Node Version
22.11.0
NPM Version
10.9.1
Score
29.6
Supply Chain
71.1
Quality
90.3
Maintenance
100
Vulnerability
98.9
License
Releases
Updated dependencies
Published on 10 Dec 2024
Updated dependencies
Published on 30 Nov 2024
Removed @types/dompurify dependency. Updated dompurify and other dependencies.
Published on 24 Nov 2024
Updated dependencies
Published on 27 Sept 2024
Updated dependencies. Switched to Vitest
Published on 27 Aug 2024
Updated dependencies
Published on 25 Jul 2024
Contributors
Languages
JavaScript (100%)
Developer
kkomelin
Download Statistics
Total Downloads
56,928,839
Last Day
78,104
Last Week
618,775
Last Month
2,696,425
Last Year
27,187,907
GitHub Statistics
428 Stars
595 Commits
13 Forks
6 Watching
1 Branches
5 Contributors
Maintainers
Package Meta Information
Latest Version
2.19.0
Package Id
isomorphic-dompurify@2.19.0
Unpacked Size
5.84 kB
Size
2.79 kB
File Count
6
NPM Version
10.9.1
Node Version
22.11.0
Publised On
10 Dec 2024
Total Downloads
Cumulative downloads
Total Downloads
56,928,839
Last day
-34.9%
78,104
Compared to previous day
Last week
-7.4%
618,775
Compared to previous week
Last month
-3.9%
2,696,425
Compared to previous month
Last year
49.5%
27,187,907
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Isomorphic DOMPurify
The library makes it possible to seamlessly use DOMPurify on server and client in the same way. It does nothing by itself except providing an isomorphic/universal wrapper around DOMPurify, so all credits go to DOMPurify authors and contributors.
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks.
Motivation
DOMPurify needs a DOM tree to base on, which is not available in Node by default. To work on the server side, we need a fake DOM to be created and supplied to DOMPurify. It means that DOMPurify initialization logic on the server is not the same as on the client.
This project was born with the idea of encapsulating DOMPurify initialization details and providing an easy way to import the library on both, server and client, for example in Next.js apps.
It was inspired by Isomorphic Unfetch.
Requirements
| isomorphic-dompurify | Node.js | Environment |
|---|---|---|
<=0.19.0 | >=12 | Server |
>=0.20.0 | >=14 | Server |
>=1.4.0 | >=16 | Server |
>=1.10.0 | >=18 | Server |
Installation
1$ npm i isomorphic-dompurify
Updates
Please note that DOMPurify library doesn't follow Semantic Versioning, so we have to release every change as a minor version because we cannot be 100% sure whether new features are added to patch DOMPurify releases or not.
Usage
Import:
1import DOMPurify from "isomorphic-dompurify";
Importing the entire module for the client/browser version is recommended.
Sanitize:
1const clean = DOMPurify.sanitize(dirtyString);
or with config:
1const clean = DOMPurify.sanitize(dirtyString, { USE_PROFILES: { html: true } });
Known Issues
- Next.js and Remix are mistakenly trying to use the
browserentry point on server, which causes theWindow is not definedissue. #228 #214 https://github.com/vercel/next.js/discussions/58142 - Can't resolve 'canvas' on Next.js serverless app
License
DOMPurify - Apache 2.0 or MPL 2.0 © 2015 Mario Heiderich
Isomorphic DOMPurify - MIT License © 2020 Konstantin Komelin and contributors
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
0 existing vulnerabilities detected
Reason
Found 0/6 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/build_test.yml:1
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_test.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/kkomelin/isomorphic-dompurify/build_test.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/build_test.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/kkomelin/isomorphic-dompurify/build_test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/build_test.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/kkomelin/isomorphic-dompurify/build_test.yml/master?enable=pin
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
branch protection not enabled on development/release branches
Details
- Warn: branch protection not enabled for branch 'master'
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 24 are checked with a SAST tool
Score
4.4
/10
Last Scanned on 2024-12-16
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to isomorphic-dompurify
universal-dompurify
💎 Use DOMPurify for some context by conditional exports
@jill64/universal-sanitizer
💎 Isomorphic html sanitizer by DOMPurify + sanitize-html
html-converter-react
**html-converter-react** is an isomorphic utility function that provides easy way to convert your string into a safely sanitized html. It's built on top of dompurify and it's made to work with react.