Benchmark: nothing vs sanitize-html

HTML Preparation code:

<script src="https://cdnjs.cloudflare.com/ajax/libs/sanitize-html/1.27.5/sanitize-html.min.js"></script>

Tests:

Nothing
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> ` const result = testString console.log(result)
Sanitize HTML
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> ` const result = sanitizeHtml(testString) console.log(result)

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
Nothing
Sanitize HTML

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one month ago):

LLMs can make mistakes. Check important info.

Let's break down the provided benchmark definition and test cases.

**What is being tested?**

The benchmark measures the performance difference between two approaches:

1. **Nothing**: This approach allows user-generated code to run without any sanitization or safety checks. The goal is to evaluate how quickly a browser can execute malicious code.
2. **Sanitize HTML**: This approach uses the `sanitize-html` library to remove harmful elements and attributes from the input code before execution.

**Options compared**

The two approaches differ in their treatment of user-generated code:

* **Nothing**: No safety checks or sanitization are applied, making it a high-risk scenario for potential security vulnerabilities.
* **Sanitize HTML**: The `sanitize-html` library is used to remove harmful elements and attributes from the input code, reducing the risk of security vulnerabilities.

**Pros and cons of each approach**

* **Nothing**:
	+ Pros: None
	+ Cons: Allows execution of malicious code, potentially leading to security breaches.
* **Sanitize HTML**:
	+ Pros:
		- Reduces the risk of security vulnerabilities by removing harmful elements and attributes.
		- Provides a safer testing environment for user-generated code.
	+ Cons:
		- May introduce performance overhead due to the added sanitization step.

**Library: sanitize-html**

The `sanitize-html` library is used to sanitize user-generated HTML code. Its purpose is to remove or escape malicious elements and attributes, making it more difficult for attackers to inject harmful code into the browser.

**Special JS feature/syntax**

There are no special JavaScript features or syntax mentioned in the benchmark definition. However, some browsers may have specific security features or settings that could affect the results.

**Other alternatives**

While `sanitize-html` is the library used in this benchmark, there are other libraries and approaches available for sanitizing user-generated HTML code, such as:

* **DOMPurify**: Another popular library for sanitizing user-generated content.
* **HTML Purifier**: A PHP-based library specifically designed for sanitizing user-generated HTML.

Keep in mind that the choice of sanitizer may impact performance and security considerations.

Latest run results:

Run details: (Test run date: 10 months ago)

User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15

Browser/OS: Safari 16 on Mac OS X 10.15.7

View result in a separate tab

Test name	Executions per second
Nothing	1010290.0 Ops/sec
Sanitize HTML	154745.1 Ops/sec

Related benchmarks:

nothing vs sanitize-html (version: 0)

Comparing performance of: Nothing vs Sanitize HTML

Created: 10 months ago by: Guest

Jump to the latest result

Nothing

Sanitize HTML

Suite status: <idle, ready to run>

Experimental features:

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one month ago):