lpm install @lpm.dev/neo.sanitize

import { sanitize } from "@lpm.dev/neo.sanitize";

// Basic usage - sanitize HTML string
const clean = sanitize("<p>Hello <strong>world</strong>!</p>");
// Output: '<p>Hello <strong>world</strong>!</p>'

// Removes dangerous content
const safe = sanitize(
  '<p onclick="alert(1)">Click</p><script>alert(1)</script>',
);
// Output: '<p>Click</p>'

sanitize('<script>alert("XSS")</script>'); // ''
sanitize("<p>Safe</p><script>alert(1)</script>"); // '<p>Safe</p>'

sanitize('<div onclick="alert(1)">Click</div>'); // '<div>Click</div>'
sanitize('<img src=x onerror="alert(1)">'); // '<img src="x">'

sanitize('<a href="javascript:alert(1)">Click</a>'); // '<a>Click</a>'
sanitize('<a href="https://safe.com">Click</a>'); // '<a href="https://safe.com">Click</a>'

sanitize('<iframe src="http://evil.com"></iframe>'); // ''
sanitize('<object data="evil.swf"></object>'); // ''
sanitize('<style>body{background:url("javascript:alert(1)")}</style>'); // ''

import { sanitize } from "@lpm.dev/neo.sanitize";

const result = sanitize("<p>Hello</p>", {
  allowedTags: ["p", "strong", "em"],
  allowedAttributes: {
    a: ["href", "title"],
    img: ["src", "alt"],
  },
  allowedProtocols: ["http", "https", "mailto"],
});

import { sanitizeBasic } from "@lpm.dev/neo.sanitize";

sanitizeBasic("<p><strong>Bold</strong> text</p>");
// Output: '<p><strong>Bold</strong> text</p>'

sanitizeBasic('<img src="image.jpg">');
// Output: '' (images not allowed in BASIC)

import { sanitizeRelaxed } from "@lpm.dev/neo.sanitize";

sanitizeRelaxed('<img src="image.jpg" alt="Photo">');
// Output: '<img src="image.jpg" alt="Photo">'

sanitizeRelaxed("<table><tr><td>Data</td></tr></table>");
// Output: '<table><tbody><tr><td>Data</td></tr></tbody></table>'

import { sanitizeStrict } from "@lpm.dev/neo.sanitize";

sanitizeStrict("<p>Just <strong>text</strong> content</p>");
// Output: 'Just text content'

sanitizeStrict("<script>alert(1)</script><p>Safe</p>");
// Output: 'Safe'

import { createSanitizer } from "@lpm.dev/neo.sanitize";

const sanitizer = createSanitizer({
  allowedTags: ["p", "strong", "em", "a"],
  allowedAttributes: {
    a: ["href", "title"],
  },
});

// Reuse the same configuration
const result1 = sanitizer.sanitize("<p>Hello</p>");
const result2 = sanitizer.sanitize('<a href="/">Link</a>');

// Get current config
const config = sanitizer.getConfig();

// Update config
sanitizer.updateConfig({ allowDataAttributes: true });

interface SanitizeOptions {
  // Tag and attribute filtering
  allowedTags?: string[]; // Default: 50+ safe HTML tags
  allowedAttributes?: Record<string, string[]>; // Tag-specific attributes
  forbiddenAttributes?: string[]; // Default: 60+ event handlers

  // Protocol filtering
  allowedProtocols?: string[]; // Default: ['http', 'https', 'mailto', 'tel', 'ftp', 'ftps']

  // Special attributes
  allowDataAttributes?: boolean; // Allow data-* attributes
  allowAriaAttributes?: boolean; // Allow aria-* attributes
  allowClassAttribute?: boolean; // Allow class attribute
  allowIdAttribute?: boolean; // Allow id attribute
  allowStyleAttribute?: boolean; // Allow style attribute
  allowAllAttributes?: boolean; // Allow all attributes (dangerous!)

  // Content handling
  keepTextContent?: boolean; // Keep text from removed tags (safe tags only)
  stripTags?: boolean; // Remove tags but keep text content

  // Output format
  returnString?: boolean; // Return string (default: true) or DocumentFragment

  // Normalization
  lowercaseTags?: boolean; // Normalize tag names to lowercase
  lowercaseAttributes?: boolean; // Normalize attribute names to lowercase
}

import { sanitize } from "@lpm.dev/neo.sanitize";

// Allow rich text formatting but no images or scripts
const cleanComment = sanitize(userComment, {
  allowedTags: ["p", "strong", "em", "a", "ul", "ol", "li", "br"],
  allowedAttributes: {
    a: ["href", "title"],
  },
  allowedProtocols: ["http", "https"],
});

import { sanitizeRelaxed } from "@lpm.dev/neo.sanitize";

// Sanitize generated HTML from markdown
const html = markdownToHtml(userMarkdown);
const safe = sanitizeRelaxed(html); // Allow tables, code blocks, etc.

import { sanitize } from "@lpm.dev/neo.sanitize";

// Very restrictive - no links, images, or scripts
const cleanEmail = sanitize(emailBody, {
  allowedTags: ["p", "strong", "em", "br"],
  allowedAttributes: {},
  keepTextContent: true,
});

import { sanitize } from "@lpm.dev/neo.sanitize";

// Allow specific tags and attributes for your use case
const result = sanitize(html, {
  allowedTags: ["div", "p", "img", "a"],
  allowedAttributes: {
    div: ["class"],
    p: ["class"],
    img: ["src", "alt", "class"],
    a: ["href", "title", "class"],
  },
  allowDataAttributes: true, // Allow data-* attributes
  allowAriaAttributes: true, // Allow aria-* attributes
  allowedProtocols: ["http", "https"],
  keepTextContent: false, // Remove content from disallowed tags
});

import { sanitize } from "@lpm.dev/neo.sanitize";

// Get DocumentFragment instead of string (for DOM manipulation)
const fragment = sanitize(html, { returnString: false }) as DocumentFragment;

// Append to DOM
document.body.appendChild(fragment);

# Run tests
npm test

# Run benchmarks
npm run bench

# Type check
npm run typecheck

# Build
npm run build

// Before (DOMPurify)
import DOMPurify from "dompurify";

const clean = DOMPurify.sanitize(dirty, {
  ALLOWED_TAGS: ["p", "strong"],
  ALLOWED_ATTR: ["href"],
});

// After (neo.sanitize)
import { sanitize } from "@lpm.dev/neo.sanitize";

const clean = sanitize(dirty, {
  allowedTags: ["p", "strong"],
  allowedAttributes: {
    a: ["href"],
  },
});

// Before (sanitize-html)
import sanitizeHtml from "sanitize-html";

const clean = sanitizeHtml(dirty, {
  allowedTags: ["p", "strong"],
  allowedAttributes: {
    a: ["href"],
  },
});

// After (neo.sanitize) - same API!
import { sanitize } from "@lpm.dev/neo.sanitize";

const clean = sanitize(dirty, {
  allowedTags: ["p", "strong"],
  allowedAttributes: {
    a: ["href"],
  },
});

import { sanitize, SanitizeOptions } from "@lpm.dev/neo.sanitize";

const options: SanitizeOptions = {
  allowedTags: ["p", "strong"],
  allowedAttributes: {
    a: ["href", "title"],
  },
};

const clean: string = sanitize(html, options);

// Import specific functions (< 1 KB)
import { sanitize } from "@lpm.dev/neo.sanitize";

// Import schema helpers (< 500 bytes each)
import {
  sanitizeBasic,
  sanitizeRelaxed,
  sanitizeStrict,
} from "@lpm.dev/neo.sanitize";

// Import core utilities
import { createSanitizer } from "@lpm.dev/neo.sanitize";