https://github.com/kkomelin/isomorphic-dompurify
Use DOMPurify on server and client in the same way
https://github.com/kkomelin/isomorphic-dompurify
dompurify html-escape isomorphic isomorphic-dompurify sanitize sanitize-html sanitizer security ssr universal wrapper xss xss-filter
Last synced: 27 days ago
JSON representation
Use DOMPurify on server and client in the same way
- Host: GitHub
- URL: https://github.com/kkomelin/isomorphic-dompurify
- Owner: kkomelin
- License: mit
- Created: 2020-03-17T16:09:17.000Z (almost 6 years ago)
- Default Branch: master
- Last Pushed: 2026-02-07T13:30:45.000Z (about 1 month ago)
- Last Synced: 2026-02-07T18:58:26.622Z (about 1 month ago)
- Topics: dompurify, html-escape, isomorphic, isomorphic-dompurify, sanitize, sanitize-html, sanitizer, security, ssr, universal, wrapper, xss, xss-filter
- Language: TypeScript
- Homepage:
- Size: 1.97 MB
- Stars: 550
- Watchers: 3
- Forks: 16
- Open Issues: 9
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# Isomorphic DOMPurify
[](https://badge.fury.io/js/isomorphic-dompurify)
[](https://github.com/kkomelin/isomorphic-dompurify/actions/workflows/build_test.yml)
The library makes it possible to seamlessly use [DOMPurify](https://github.com/cure53/DOMPurify) on server and client in the same way.
It does nothing by itself except providing an isomorphic/universal wrapper around DOMPurify, so all credits go to DOMPurify authors and contributors.
> DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks.
- [DOMPurify Demo](https://cure53.de/purify)
- [DOMPurify Documentation](https://github.com/cure53/DOMPurify/blob/master/README.md)
## Motivation
DOMPurify needs a DOM tree to base on, which is not available in Node by default. To work on the server side, we need a fake DOM to be created and supplied to DOMPurify. It means that DOMPurify initialization logic on the server is not the same as on the client.
This project was born with the idea of encapsulating DOMPurify initialization details and providing an easy way to import the library on both, server and client, for example in Next.js apps.
It was inspired by [Isomorphic Unfetch](https://github.com/developit/unfetch/tree/master/packages/isomorphic-unfetch).
## Requirements
| isomorphic-dompurify | Node.js | Environment |
| ------------- | ------------- | ------------- |
| `<=0.19.0` | `>=12` | Server |
| `>=0.20.0` | `>=14` | Server |
| `>=1.4.0` | `>=16` | Server |
| `>=1.10.0` | `>=18` | Server |
| `>=2.27.0` | `>=20` | Server |
| `>=2.30.0` | `>=20.19.5` | Server |
| `>=3.0.0` | `^20.19.0 \|\| ^22.12.0 \|\| >=24.0.0` | Server |
## Installation
```shell_script
$ npm i isomorphic-dompurify
```
## Updates
Please note that DOMPurify library [doesn't follow Semantic Versioning](https://github.com/cure53/DOMPurify/issues/446#issuecomment-643761433), so we have to release every change as a minor version because we cannot be 100% sure whether new features are added to patch DOMPurify releases or not.
## Usage
```javascript
import DOMPurify from "isomorphic-dompurify";
const clean = DOMPurify.sanitize(dirtyString);
```
You can pass [config](https://github.com/cure53/DOMPurify/blob/main/README.md) as a second argument:
```javascript
const clean = DOMPurify.sanitize(dirtyString, { USE_PROFILES: { html: true } });
```
Named imports are also supported:
```javascript
import { sanitize } from "isomorphic-dompurify";
const clean = sanitize(dirtyString);
```
## Memory Management (Server)
In long-running Node.js processes, the internal jsdom window accumulates DOM state across sanitization calls, which can cause progressive slowdown and memory growth. Use `clearWindow()` to periodically release these resources:
```javascript
import { sanitize, clearWindow } from "isomorphic-dompurify";
// Sanitize as usual
const clean = sanitize(dirtyString);
// Release jsdom resources when appropriate (e.g. after a request, after a batch)
clearWindow();
```
`clearWindow()` closes the current jsdom window and creates a fresh one. All import styles (default and named) continue to work after calling it.
> **Note:** Any hooks or config set via `addHook`/`setConfig` will need to be re-applied after calling `clearWindow()`. In the browser build, `clearWindow()` is a no-op.
## Web Worker Support
The `isomorphic-dompurify` library is [compatible with Web Workers](https://github.com/kkomelin/isomorphic-dompurify/pull/242),
however, `dompurify`, which it depends upon, [is not, at least not yet](https://github.com/cure53/DOMPurify/issues/577).
## Playgrounds
Want to try `isomorphic-dompurify` with your favorite framework? Check out [isomorphic-dompurify-playgrounds](https://github.com/kkomelin/isomorphic-dompurify-playgrounds) — minimal setups for popular frameworks including Astro, Next.js, Nuxt, React and Svelte.
## License
DOMPurify -
[Apache 2.0 or MPL 2.0](https://github.com/cure53/DOMPurify/blob/master/LICENSE)
© 2015 Mario Heiderich
Isomorphic DOMPurify - [MIT License](LICENSE) © 2020 [Konstantin Komelin](https://github.com/kkomelin) and [contributors](https://github.com/kkomelin/isomorphic-dompurify/graphs/contributors)