<script src="https://cdnjs.cloudflare.com/ajax/libs/sanitize-html/1.27.5/sanitize-html.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.2.7/purify.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-xss/0.3.3/xss.min.js"></script>
const testString = `
<b>Welcome to safeland</b><br>
<a href='javascript:alert(1)'>This is fun</a><br>
<img src=x onerror=console.log(1)>
`
const result = DOMPurify.sanitize(testString)
const testString = `
<b>Welcome to safeland</b><br>
<a href='javascript:alert(1)'>This is fun</a><br>
<img src=x onerror=console.log(1)>
`
const result = sanitizeHtml(testString)
const testString = `
<b>Welcome to safeland</b><br>
<a href='javascript:alert(1)'>This is fun</a><br>
<img src=x onerror=console.log(1)>
`
const result = filterXSS(testString)
--enable-precise-memory-info
flag.
Test case name | Result |
---|---|
DOMPurify | |
Sanitize HTML | |
js-xss |
Test name | Executions per second |
---|---|
DOMPurify | 11816.4 Ops/sec |
Sanitize HTML | 69041.7 Ops/sec |
js-xss | 202509.6 Ops/sec |
I'll break down the provided benchmark and explain what's being tested, compared, and the pros/cons of each approach.
What's being tested:
The benchmark compares three JavaScript libraries:
DOMPurify
by Joel Bendingersanitize-html
by John Resigjs-xss
by Jonas WaltherEach library is used to sanitize HTML input, which helps prevent cross-site scripting (XSS) attacks.
Options compared:
The benchmark compares the performance of each library on a specific test case:
DOMPurify
sanitize-html
js-xss
The options being compared are the execution speed of each library, measured in executions per second (ExecutionsPerSecond
).
Pros and Cons:
Here's a brief overview of each library's strengths and weaknesses:
Library descriptions:
DOMPurify
: A lightweight library that uses a whitelist approach to sanitize HTML input. It's designed for simplicity and ease of use, making it suitable for production environments.sanitize-html
: A more comprehensive library than DOMPurify, using a whitelist approach with customizable settings. It covers a wider range of HTML elements and attributes, making it suitable for applications that require additional protection against XSS attacks.js-xss
: A lightweight library that uses a blacklist approach to prevent XSS attacks. It's designed for performance and ease of use, making it suitable for production environments where speed is critical.Special JavaScript features or syntax:
None are explicitly mentioned in the benchmark definitions or results. However, each library may have its own configuration options or settings that can be adjusted to fine-tune performance or security.
Alternatives:
If you're considering using these libraries or exploring alternative solutions:
Keep in mind that each alternative has its own strengths and weaknesses, and the choice ultimately depends on your specific use case and performance requirements.