Project: syntax-tree/hast-util-sanitize

Package: hast-util-sanitize@4.0.0

  1. Dependents: 0
  2. hast utility to sanitize nodes
  1. util 144
  2. utility 140
  3. unist 129
  4. html 124
  5. hast 74
  6. hast-util 47
  7. clean 6
  8. sanitize 3
  9. xss 2


Build Coverage Downloads Size Sponsors Backers Chat

hast utility to sanitize a tree.


This package is ESM only: Node 12+ is needed to use it and it must be imported instead of required.


npm install hast-util-sanitize


import {u} from 'unist-builder'
import {h} from 'hastscript'
import {sanitize} from 'hast-util-sanitize'
import {toHtml} from 'hast-util-to-html'

const tree = h('div', {onmouseover: 'alert("alpha")'}, [
    {href: 'jAva script:alert("bravo")', onclick: 'alert("charlie")'},
  u('text', '\n'),
  h('script', 'alert("charlie")'),
  u('text', '\n'),
  h('img', {src: 'x', onerror: 'alert("delta")'}),
  u('text', '\n'),
  h('iframe', {src: 'javascript:alert("echo")'}),
  u('text', '\n'),
  h('math', h('mi', {'xlink:href': 'data:x,<script>alert("foxtrot")</script>'}))

const unsanitized = toHtml(tree)
const sanitized = toHtml(sanitize(tree))



<div onmouseover="alert(&#x22;alpha&#x22;)"><a href="jAva script:alert(&#x22;bravo&#x22;)" onclick="alert(&#x22;charlie&#x22;)">delta</a>
<img src="x" onerror="alert(&#x22;delta&#x22;)">
<iframe src="javascript:alert(&#x22;echo&#x22;)"></iframe>
<math><mi xlink:href="data:x,<script>alert(&#x22;foxtrot&#x22;)</script>"></mi></math></div>



<img src="x">



This package exports the following identifiers: sanitize, defaultSchema. There is no default export.

sanitize(tree[, schema])

Sanitize a hast tree.


Node — A new, sanitized tree.


Configuration. If not given, defaults to GitHub style sanitation. If any top-level key isn’t given, it defaults to GitHub’s style too.

For a thorough sample, see the code for defaultSchema.

To extend the standard schema with a few changes, clone defaultSchema like so:

import {h} from 'hastscript'
import deepmerge from 'deepmerge'
import {sanitize, defaultSchema} from 'hast-util-sanitize'

var schema = deepmerge(defaultSchema, {attributes: {'*': ['className']}})

var tree = sanitize(h('div', {className: ['foo']}), schema)

// `tree` still has `className`.
// {
//   type: 'element',
//   tagName: 'div',
//   properties: {className: ['foo']},
//   children: []
// }

Map of tag names to allowed property names (Object.<Array.<string>>).

The special '*' key defines property names allowed on all elements.

One special value, namely 'data*', can be used to allow all data properties.

attributes: {
  a: ['href'],
  img: ['src', 'longDesc'],
  // …
  '*': [
    // …

Instead of a single string (such as type), which allows any property value of that property name, it’s also possible to provide an array (such as ['type', 'checkbox']), where the first entry is the property name, and all other entries allowed property values.

This is how the default GitHub schema allows only disabled checkbox inputs:

attributes: {
  // …
  input: [
    ['type', 'checkbox'],
    ['disabled', true]
  // …

This also plays well with properties that accept space- or comma-separated values, such as class. Say you wanted to allow certain classes on span elements for syntax highlighting, that can be done like this:

// …
span: [
  ['className', 'token', 'number', 'operator']
// …

Map of tag names to required property names and their default property value (Object.<Object.<*>>). If the defined keys do not exist in an element’s properties, they are added and set to the specified value.

Note that properties are first checked based on the schema at attributes, so properties could be removed by that step and then added again through required.

required: {
  input: {type: 'checkbox', disabled: true}

List of allowed tag names (Array.<string>).

tagNames: [
  // …

Map of protocols to allow in property values (Object.<Array.<string>>).

protocols: {
  href: ['http', 'https', 'mailto'],
  // …
  longDesc: ['http', 'https']

Map of tag names to their required ancestor elements (Object.<Array.<string>>).

ancestors: {
  li: ['ol', 'ul'],
  // …
  tr: ['table']

List of allowed property names which can clobber (Array.<string>).

clobber: ['name', 'id']

Prefix to use before potentially clobbering property names (string).

clobberPrefix: 'user-content-'

Names of elements to strip from the tree (Array.<string>).

By default, unsafe elements are replaced by their children. Some elements, should however be entirely stripped from the tree.

strip: ['script']

Whether to allow comments (boolean, default: false).

allowComments: true

Whether to allow doctypes (boolean, default: false).

allowDoctypes: true


Improper use of hast-util-sanitize can open you up to a cross-site scripting (XSS) attack. The defaults are safe, but deviating from them is likely unsafe.

Use hast-util-sanitize after all other utilities, as other utilities are likely also unsafe.


See contributing.md in syntax-tree/.github for ways to get started. See support.md for ways to get help.

This project has a code of conduct. By interacting with this repository, organization, or community you agree to abide by its terms.


MIT © Titus Wormer