Sanitise/strip Javascript from HTML

Question

I have a string that contains HTML (from Markdown), other people can submit these and these strings are rendered on a webpage as actual HTML.

I'd like to safely strip every bit of Javascript from this HTML, whether it's in script tags or attributes.

What's the best/safest way of doing this?

Answer 1

Try the safe-html package.

Basically, It santitizes HTML using a whitelist of allowed elements and attributes. Parses the HTML using parse5 which uses the HTML5 parsing algorithm (meaning it should parse documents the same way your browser does).

Hope this helps!