Benchmark: Dompurify 2.3.3 vs sanitize-html

HTML Preparation code:

<script src="https://cdnjs.cloudflare.com/ajax/libs/sanitize-html/1.27.5/sanitize-html.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.3.3/purify.min.js"></script>

Tests:

DOMPurify
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> ` const result = DOMPurify.sanitize(testString)
Sanitize HTML
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> ` const result = sanitizeHtml(testString)

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
DOMPurify
Sanitize HTML

Fastest: N/A

Slowest: N/A

Latest run results:

Run details: (Test run date: 3 years ago)

User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.54 Safari/537.36

Browser/OS: Chrome 95 on Mac OS X 10.15.7

View result in a separate tab

Test name	Executions per second
DOMPurify	5677.7 Ops/sec
Sanitize HTML	42100.9 Ops/sec

Autogenerated LLM Summary (model llama3.2:3b, generated 2 months ago):

LLMs can make mistakes. Check important info.

Let's break down the provided JSON benchmark and explain what is tested, compared, and some pros/cons of different approaches.

**Benchmark Overview**

The benchmark compares two HTML sanitization libraries: `DOMPurify` (version 2.3.3) and `sanitize-html` (version 1.27.5).

**Script Preparation Code**

The script preparation code includes links to the required JavaScript files for both libraries:

* `sanitize-html`: `https://cdnjs.cloudflare.com/ajax/libs/sanitize-html/1.27.5/sanitize-html.min.js`
* `DOMPurify`: `https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.3.3/purify.min.js`

**Individual Test Cases**

There are two test cases:

### Test Case 1: DOMPurify

The benchmark definition for this test case is:
```javascript
const testString = `\r\nWelcome to safeland \r\n<a href='javascript:alert(1)'>This is fun</a> \r\n<img src=x onerror=console.log(1)>\r\n`\r\nconst result = DOMPurify.sanitize(testString);
```
This test case uses the `DOMPurify` library to sanitize a malicious HTML string. The input string contains:

* A `` tag with a closing `` tag
* An `<a>` tag with a `href` attribute that executes a JavaScript alert
* An `<img>` tag with an `src` attribute set to `x`, which is a deliberate invalid value, and an `onerror` event handler that logs a message to the console

The test case checks how quickly the `DOMPurify.sanitize()` method can process this malicious input.

### Test Case 2: Sanitize HTML

The benchmark definition for this test case is:
```javascript
const testString = `\r\nWelcome to safeland \r\n<a href='javascript:alert(1)'>This is fun</a> \r\n<img src=x onerror=console.log(1)>\r\n`\r\nconst result = sanitizeHtml(testString);
```
This test case uses the `sanitize-html` library to sanitize the same malicious HTML string. The input string is identical to the previous test case.

**Pros and Cons of Different Approaches**

Both libraries aim to remove malicious characters from the input HTML string, preventing XSS attacks. Here are some pros and cons of each approach:

* **DOMPurify**: Pros:
	+ Easy to use: simply pass the input HTML string to `DOMPurify.sanitize()`
	+ Fast: optimized for performance
Cons:
	+ May not handle all edge cases (e.g., nested tags, complex attribute values)
	+ Can be less accurate than other libraries in detecting certain types of attacks
* **sanitize-html**: Pros:
	+ More comprehensive: handles a wide range of HTML elements and attributes
	+ More accurate: detects more complex attacks and edge cases
Cons:
	+ May be slower than DOMPurify due to its more extensive sanitization logic
	+ Requires more configuration options

**Other Considerations**

* **Library Purpose**: Both libraries are designed to sanitize HTML input, preventing cross-site scripting (XSS) attacks. However, they differ in their approach and accuracy.
* **Special JS Feature**: None mentioned explicitly.

**Alternatives**

If you're looking for alternative HTML sanitization libraries, consider:

* `html-minifier`: a fast and lightweight library that minimizes HTML while removing malicious characters
* `js-sanitizer`: a more comprehensive library that detects a wide range of attacks and offers customization options

Keep in mind that each library has its strengths and weaknesses, and the choice ultimately depends on your specific requirements and performance needs.

Related benchmarks:

Dompurify 2.3.3 vs sanitize-html (version: 0)

Comparing performance of: DOMPurify vs Sanitize HTML

Created: 3 years ago by: Guest

Jump to the latest result

DOMPurify

Sanitize HTML

Suite status: <idle, ready to run>

Experimental features:

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated 2 months ago):