question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Remove HTML sanitizer

See original GitHub issue

https://github.com/apostrophecms/sanitize-html#browser

It is meant to be used in node servers. Not browsers. It takes up a huge chunk of bundle as well.

As written in the repo, think, why do you need to sanitize HTML on client? That is the job of server. Besides I believe, we shouldn’t even be storing HTML in backend. It should store markup like markdown, not DOM (#2493). Most people are not using our rich descriptions feature and it is needlessly storing <p> tags in DB without any reason

Trigger Reason: We need to allow polyfills of node dependencies like path in order to include it in the build - https://github.com/ef4/ember-auto-import/issues/224#issuecomment-503400386 As ember-auto-import now correctly removes node builtins being polyfilled

Edit: HTML-sanitizer has been relaced with dompurify

180 KB -> 16 KB

We still have to remove sanitization from frontend, its role of the backend

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:7 (7 by maintainers)

github_iconTop GitHub Comments

2reactions
maze-runnarcommented, Oct 23, 2021

I am not finding any instance of html-sanitizer in the project currently. Feel free to reopen if you find something. @pc-beast @progmatic-99

1reaction
adrijshikharcommented, Feb 15, 2020

people have already called dibs on most the issues. i will still explore.

Read more comments on GitHub >

github_iconTop Results From Across the Web

HTML sanitizer - Product Documentation | ServiceNow
HTML sanitization works by removing HTML tags that could be used to compromise your instance, such as <script> , <link> , or <embed>...
Read more >
Any way to completely remove all html tags? · Issue #8 - GitHub
Currently when I initialize the sanitizer like this: sanitizer ... The second lxml Cleaner pass should remove the strong tag, but something ...
Read more >
html sanitizer remove custom tag and keep inner content
I've been looking for the same thing. I found that HtmlSanitizer has a KeepChildNodes option in version 3.4.156, which I'm using, that does...
Read more >
sanitize-html - npm
sanitize-html provides a simple HTML sanitizer with a clear API. sanitize-html is tolerant. It is well suited for cleaning up HTML fragments ...
Read more >
HTML Sanitizer API - MDN Web Docs
The script element is disallowed by the default sanitizer so the alert is removed. const unsanitized_string = "abc <script>alert(1)<" + "/script> ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found