https://github.com/cure53/DOMPurify
cross-site-scripting dom dompurify html javascript mathml prevent-xss-attacks sanitizer security svg xss
Score: 36.320491053651686
Last synced: about 6 hours ago
JSON representation
Repository metadata:
DOMPurify - a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. DOMPurify works with a secure default, but offers a lot of configurability and hooks. Demo:
- Host: GitHub
- URL: https://github.com/cure53/DOMPurify
- Owner: cure53
- License: apache-2.0
- Created: 2014-02-17T21:48:14.000Z (over 12 years ago)
- Default Branch: main
- Last Pushed: 2026-08-16T00:56:45.000Z (8 days ago)
- Last Synced: 2026-08-16T13:39:32.933Z (7 days ago)
- Topics: cross-site-scripting, dom, dompurify, html, javascript, mathml, prevent-xss-attacks, sanitizer, security, svg, xss
- Language: JavaScript
- Homepage: https://cure53.de/purify
- Size: 12.8 MB
- Stars: 17,307
- Watchers: 146
- Forks: 857
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: CODEOWNERS
- Security: SECURITY.md
-
Funding:
- Github: cure53
Owner metadata:
- Name: Cure53
- Login: cure53
- Email: mario@cure53.de
- Kind: user
- Description: And there is fire where we walk.
- Website: https://cure53.de
- Location: Berlin
- Twitter:
- Company: Fine penetration tests for fine websites
- Icon url: https://avatars.githubusercontent.com/u/6709482?u=4149eb5ebf4e59175c31bbc618805bce4d0535dc&v=4
- Repositories: 21
- Last Synced at: 2026-08-23T00:26:45.080Z
- Profile URL: https://github.com/cure53
GitHub Events
Total
- Commit comment event: 10
- Create event: 114
- Delete event: 89
- Fork event: 101
- Issue comment event: 386
- Issues event: 130
- Pull request event: 193
- Pull request review comment event: 44
- Pull request review event: 28
- Push event: 260
- Release event: 10
- Watch event: 2083
- Total: 3448
Last Year
- Commit comment event: 7
- Create event: 103
- Delete event: 85
- Fork event: 14
- Issue comment event: 62
- Issues event: 25
- Pull request event: 92
- Pull request review event: 10
- Push event: 181
- Release event: 2
- Watch event: 457
- Total: 1038
Committers metadata
Last synced: 5 days ago
Total Commits: 2,040
Total Committers: 136
Avg Commits per committer: 15.0
Development Distribution Score (DDS): 0.416
Commits in past year: 294
Committers in past year: 16
Avg Commits per committer in past year: 18.375
Development Distribution Score (DDS) in past year: 0.395
| Name | Commits | |
|---|---|---|
| Mario Heiderich | m****o@c****e | 1192 |
| dependabot[bot] | 4****] | 148 |
| tdeekens | n****d@t****e | 102 |
| mario | m****o@m****) | 72 |
| Neil Jenkins | n****l@n****m | 58 |
| ssi02014 | s****4@n****m | 47 |
| Issei Horie | i****e@i****m | 42 |
| Frederic Hemberger | m****l@f****e | 28 |
| suǝʞǝǝpʇ | t****s@e****e | 19 |
| Michal Bentkowski | m****i@s****l | 19 |
| reduckted | r****d@o****m | 17 |
| Malvoz | 2****z | 17 |
| Tobias Smolka | t****a@m****m | 14 |
| Joris van der Wel | j****s@j****m | 14 |
| Yehonatan Daniv | y****d@w****m | 13 |
| Rotzbua | R****a | 13 |
| filedescriptor | f****r@g****m | 10 |
| Conrad Irwin | c****n@g****m | 8 |
| NateScarlet | N****t@G****m | 7 |
| Richard Gibson | r****n@g****m | 6 |
| William Chou | w****u@g****m | 6 |
| Ahmed Elsobky | 0****y@g****m | 5 |
| Drew Neil | a****l@g****m | 5 |
| Edward | 1****d | 5 |
| Grant Gryczan | g****n@g****m | 5 |
| Krzysztof Kotowicz | k****o@g****m | 5 |
| mscheele7 | m****e@o****m | 4 |
| Steven | s****n@c****m | 4 |
| Frank Topel | i****o@c****e | 4 |
| dhoko | d****o@c****g | 4 |
| and 106 more... | ||
Issue and Pull Request metadata
Last synced: about 6 hours ago
Total issues: 289
Total pull requests: 480
Average time to close issues: 4 days
Average time to close pull requests: 1 day
Total issue authors: 253
Total pull request authors: 60
Average comments per issue: 3.9
Average comments per pull request: 0.59
Merged pull request: 344
Bot issues: 0
Bot pull requests: 114
Past year issues: 46
Past year pull requests: 208
Past year average time to close issues: 2 days
Past year average time to close pull requests: about 11 hours
Past year issue authors: 40
Past year pull request authors: 11
Past year average comments per issue: 3.74
Past year average comments per pull request: 0.22
Past year merged pull request: 141
Past year bot issues: 0
Past year bot pull requests: 80
Top Issue Authors
- kkmuffme (8)
- nelstrom (5)
- spaceemotion (3)
- asamuzaK (3)
- abn875885-jpg (3)
- sgudishettys (2)
- kakao-bishop-cho (2)
- JeremyBradshaw7 (2)
- joebordes (2)
- fabiospampinato (2)
- onzag (2)
- lzj722 (2)
- gitmhd (2)
- george-thomas-hill (2)
- Rotzbua (2)
Top Pull Request Authors
- cure53 (223)
- dependabot[bot] (114)
- Rotzbua (17)
- ssi02014 (16)
- reduckted (12)
- nelstrom (4)
- asamuzaK (4)
- Gigabyte5671 (4)
- danishdazer (4)
- icesfont (4)
- hhk-png (2)
- KanhaKanhaiya (2)
- svdb99 (2)
- HugoPoi (2)
- reey (2)
Top Issue Labels
Top Pull Request Labels
- dependencies (114)
- javascript (82)
- github_actions (32)
Package metadata
- Total packages: 16
-
Total downloads:
- npm: 237,208,139 last-month
- Total docker downloads: 2,286,374,267
- Total dependent packages: 1,725 (may contain duplicates)
- Total dependent repositories: 56,677 (may contain duplicates)
- Total versions: 416
- Total maintainers: 2
- Total advisories: 28
debian-12: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Documentation: https://packages.debian.org/bookworm/node-dompurify
- Licenses: apache-2.0
- Latest release: 2.4.1+dfsg+~2.4.0-2+deb12u1 (published 6 months ago)
- Last Synced: 2026-03-13T21:51:32.753Z (5 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 0.142%
- Stargazers count: 0.178%
- Forks count: 0.39%
npmjs.org: dompurify
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is written by security people who have vast background in web a
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: (MPL-2.0 OR Apache-2.0)
- Latest release: 3.4.14 (published 5 days ago)
- Last Synced: 2026-08-22T16:35:40.263Z (1 day ago)
- Versions: 151
- Dependent Packages: 1,705
- Dependent Repositories: 56,633
- Downloads: 237,208,130 Last month
- Docker Downloads: 2,286,374,267
-
Rankings:
- Dependent packages count: 0.045%
- Docker downloads count: 0.057%
- Downloads: 0.059%
- Dependent repos count: 0.128%
- Average: 0.441%
- Stargazers count: 0.931%
- Forks count: 1.424%
- Maintainers (1)
-
Advisories:
- DOMPurify: IN_PLACE hook removal leaves a detached subtree executable, causing XSS
- DOMPurify: `CUSTOM_ELEMENT_HANDLING` bypasses `afterSanitizeElements` for allowed custom elements.
- DOMPurify: Permanent `ALLOWED_ATTR` pollution via `setConfig()` bypassing the hook clone-guard (incomplete fix of the 3.4.7 hook-pollution patch)
- DOMPurify: Trusted Types policy survives `clearConfig()` and can poison later `RETURN_TRUSTED_TYPE` output
- DOMPurify: SAFE_FOR_TEMPLATES bypass - template expressions survive sanitization inside <template> content when using DOM output modes
- DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content
- DOMPurify: `IN_PLACE` mode trusts attacker-controlled `nodeName` on live non-form nodes, allowing script retention and XSS via attacker-supplied DOM objects
- DOMPurify: Hook mutation of `data.allowedTags` / `data.allowedAttributes` permanently pollutes `DEFAULT_ALLOWED_TAGS` / `DEFAULT_ALLOWED_ATTR`
- DOMPurify: Cross-realm IN_PLACE sanitization leaves executable markup intact via realm-bound `instanceof` checks
- DOMPurify: IN_PLACE mode preserves attributes of a clobbered root element, allowing XSS via attacker-controlled root DOM
- DOMPurify XSS via selectedcontent re-clone
- DOMPurify: FORBID_TAGS bypassed by function-based ADD_TAGS predicate (asymmetry with FORBID_ATTR fix)
- DOMPurify has a SAFE_FOR_TEMPLATES bypass in RETURN_DOM mode
- DOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
- DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
- DOMPurify ADD_ATTR predicate skips URI validation
- DOMPurify USE_PROFILES prototype pollution allows event handlers
- DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
- DOMPurify contains a Cross-site Scripting vulnerability
- DOMPurify contains a Cross-site Scripting vulnerability
- DOMPurify allows Cross-site Scripting (XSS)
- DOMPurify vulnerable to tampering by prototype polution
- DOMpurify has a nesting-based mXSS
- DOMPurify allows tampering by prototype pollution
- DOMPurify Open Redirect vulnerability
- Cross-site Scripting in dompurify
- Cross-Site Scripting in dompurify
- Cross-Site Scripting in dompurify
bower.io: dompurify
A DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: ["MPL-2.0", "Apache-2.0"]
- Latest release: 3.3.1 (published 9 months ago)
- Last Synced: 2026-03-10T19:47:04.075Z (6 months ago)
- Versions: 133
- Dependent Packages: 1
- Dependent Repositories: 38
-
Rankings:
- Stargazers count: 0.612%
- Forks count: 1.468%
- Average: 2.552%
- Dependent repos count: 2.851%
- Dependent packages count: 5.277%
proxy.golang.org: github.com/cure53/Dompurify
- Homepage:
- Status: removed
- Documentation: https://pkg.go.dev/github.com/cure53/Dompurify#section-documentation
- Licenses: apache-2.0
- Latest release: v0.0.0-20240511100124-3fe78d750110 (published over 2 years ago)
- Last Synced: 2026-08-22T16:33:38.324Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent packages count: 4.482%
- Average: 4.633%
- Dependent repos count: 4.783%
repo1.maven.org: org.webjars.npm:dompurify
WebJar for dompurify
- Homepage: https://www.webjars.org
- Documentation: https://appdoc.app/artifact/org.webjars.npm/dompurify/
- Licenses: MPL-2.0,Apache-2.0
- Latest release: 3.4.14 (published 4 days ago)
- Last Synced: 2026-08-22T16:35:09.480Z (1 day ago)
- Versions: 75
- Dependent Packages: 16
- Dependent Repositories: 6
-
Rankings:
- Stargazers count: 2.674%
- Dependent packages count: 3.857%
- Average: 5.903%
- Forks count: 7.164%
- Dependent repos count: 9.917%
repo1.maven.org: org.webjars.bower:dompurify
WebJar for dompurify
- Homepage: http://webjars.org
- Documentation: https://appdoc.app/artifact/org.webjars.bower/dompurify/
- Licenses: MPL-2.0,Apache-2.0
- Latest release: 1.0.7 (published almost 8 years ago)
- Last Synced: 2026-08-22T16:34:40.947Z (1 day ago)
- Versions: 4
- Dependent Packages: 3
- Dependent Repositories: 0
-
Rankings:
- Stargazers count: 2.311%
- Forks count: 5.998%
- Average: 14.298%
- Dependent packages count: 16.904%
- Dependent repos count: 31.98%
npmjs.org: @brokenglassinmyfeet/dompurifyplusplus
DOMPurifyPlusPlus is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG.
- Homepage: https://github.com/cure53/DOMPurify#readme
- Licenses: MIT
- Latest release: 3.2.0 (published almost 2 years ago)
- Last Synced: 2026-08-22T17:31:05.634Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
- Downloads: 9 Last month
-
Rankings:
- Stargazers count: 0.719%
- Forks count: 1.162%
- Average: 16.106%
- Dependent repos count: 25.545%
- Dependent packages count: 36.999%
- Maintainers (1)
repo1.maven.org: org.webjars.bowergithub.cure53:dompurify
WebJar for DOMPurify
- Homepage: https://www.webjars.org
- Documentation: https://appdoc.app/artifact/org.webjars.bowergithub.cure53/dompurify/
- Licenses: MPL-2.0,Apache-2.0
- Latest release: 2.3.3 (published almost 5 years ago)
- Last Synced: 2026-08-22T16:33:17.027Z (1 day ago)
- Versions: 13
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Stargazers count: 2.311%
- Forks count: 5.998%
- Average: 22.287%
- Dependent repos count: 31.98%
- Dependent packages count: 48.86%
repo1.maven.org: org.webjars.bower:DOMPurify
WebJar for DOMPurify
- Homepage: http://webjars.org
- Documentation: https://appdoc.app/artifact/org.webjars.bower/DOMPurify/
- Licenses: MIT
- Latest release: 0.6.2 (published over 11 years ago)
- Last Synced: 2026-08-22T16:35:11.622Z (1 day ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Stargazers count: 2.311%
- Forks count: 5.998%
- Average: 22.287%
- Dependent repos count: 31.98%
- Dependent packages count: 48.86%
repo1.maven.org: org.mvnpm:dompurify
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It runs as JavaScript and works in all modern browsers, as well as in Node.js (via jsdom). DOMPurify is written by security people who have vast background in web a
- Homepage: https://github.com/cure53/DOMPurify
- Documentation: https://appdoc.app/artifact/org.mvnpm/dompurify/
- Licenses: (MPL-2.0 OR Apache-2.0)
- Latest release: 3.4.14 (published 4 days ago)
- Last Synced: 2026-08-22T16:34:42.985Z (1 day ago)
- Versions: 30
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 31.655%
- Average: 38.455%
- Dependent packages count: 45.256%
ubuntu-23.10: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: apache-2.0
- Latest release: 2.4.1+dfsg+~2.4.0-1 (published 6 months ago)
- Last Synced: 2026-03-14T09:19:24.029Z (5 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-24.04: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: apache-2.0
- Latest release: 3.0.9+dfsg+~3.0.5-1 (published 7 months ago)
- Last Synced: 2026-03-10T19:41:12.104Z (6 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-23.04: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: apache-2.0
- Latest release: 2.4.1+dfsg+~2.4.0-1 (published 6 months ago)
- Last Synced: 2026-03-11T22:42:56.305Z (6 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-22.04: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: apache-2.0
- Latest release: 2.3.3+dfsg-1 (published 7 months ago)
- Last Synced: 2026-03-10T19:41:20.339Z (6 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
ubuntu-24.10: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Licenses: apache-2.0
- Latest release: 3.0.9+dfsg+~3.0.5-1 (published 7 months ago)
- Last Synced: 2026-03-10T20:29:18.802Z (6 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
debian-13: node-dompurify
- Homepage: https://github.com/cure53/DOMPurify
- Documentation: https://packages.debian.org/trixie/node-dompurify
- Licenses: apache-2.0
- Latest release: 3.1.7+dfsg+~3.0.5-2 (published 6 months ago)
- Last Synced: 2026-03-14T07:03:12.855Z (5 months ago)
- Versions: 1
- Dependent Packages: 0
- Dependent Repositories: 0
-
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Dependencies
package-lock.json
npm
- 758 dependencies
package.json
npm
- @babel/core ^7.17.8 development
- @babel/preset-env ^7.16.11 development
- @rollup/plugin-babel ^5.3.1 development
- @rollup/plugin-commonjs ^21.0.3 development
- @rollup/plugin-node-resolve ^13.1.3 development
- @rollup/plugin-replace ^4.0.0 development
- cross-env ^7.0.3 development
- eslint-config-prettier ^8.5.0 development
- eslint-plugin-prettier ^4.0.0 development
- jquery ^3.6.0 development
- jsdom ^19.0.0 development
- karma ^6.3.17 development
- karma-browserstack-launcher ^1.5.1 development
- karma-chrome-launcher ^3.1.0 development
- karma-firefox-launcher ^2.1.2 development
- karma-qunit ^4.1.2 development
- karma-rollup-preprocessor ^7.0.8 development
- lodash.sample ^4.2.1 development
- minimist ^1.2.6 development
- npm-run-all ^4.1.5 development
- pre-commit ^1.2.2 development
- prettier ^2.5.1 development
- qunit ^2.4.1 development
- qunit-tap ^1.5.0 development
- rimraf ^3.0.2 development
- rollup ^2.70.1 development
- rollup-plugin-includepaths ^0.2.3 development
- rollup-plugin-terser ^7.0.2 development
- xo ^0.48.0 development
.github/workflows/build-and-test.yml
actions
- GabrielBB/xvfb-action v1.6 composite
- actions/checkout v3 composite
- actions/setup-node v3 composite
.github/workflows/codeql-analysis.yml
actions
- actions/checkout v3 composite
- github/codeql-action/analyze v2 composite
- github/codeql-action/autobuild v2 composite
- github/codeql-action/init v2 composite
typescript/esm-with-no-types/package.json
npm
typescript/esm-with-specific-types/package.json
npm
typescript/esm/package.json
npm
typescript/package.json
npm
- dompurify file:..
.github/workflows/fuzz.yml
actions
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 composite
- step-security/harden-runner b09bb98e06d4d774595224525879c09bc6e98c40 composite
.github/workflows/scorecard.yml
actions
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/upload-artifact 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a composite
- github/codeql-action/upload-sarif 5595ccaf912efad79be6eef63a5619ff05969be3 composite
- ossf/scorecard-action 2d1146689b8cda280b9bc96326124645441f03bc composite
- step-security/harden-runner b09bb98e06d4d774595224525879c09bc6e98c40 composite
.github/workflows/legacy-browsers.yml
actions
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 composite
- step-security/harden-runner b09bb98e06d4d774595224525879c09bc6e98c40 composite
test/legacy-playwright/package.json
npm
- playwright 1.50.1
- playwright 1.44.1
- playwright 1.40.0
- playwright 1.35.1
- playwright 1.30.0
.github/workflows/dependency-review.yml
actions
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/dependency-review-action a1d282b36b6f3519aa1f3fc636f609c47dddb294 composite
- step-security/harden-runner b09bb98e06d4d774595224525879c09bc6e98c40 composite
.github/workflows/sign-release.yml
actions
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- sigstore/gh-action-sigstore-python 790bc6befb9d733738f18d8f895854b453640ec9 composite
- step-security/harden-runner b09bb98e06d4d774595224525879c09bc6e98c40 composite
.github/workflows/build-and-test-skip.yml
actions
.github/workflows/slsa-provenance.yml
actions
- actions/attest-build-provenance 0f67c3f4856b2e3261c31976d6725780e5e4c373 composite
- actions/checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 composite
- actions/setup-node 820762786026740c76f36085b0efc47a31fe5020 composite
- step-security/harden-runner b09bb98e06d4d774595224525879c09bc6e98c40 composite
test/legacy-playwright/package-lock.json
npm
- fsevents 2.3.2
- playwright 1.30.0
- playwright 1.35.1
- playwright 1.40.0
- playwright 1.50.1
- playwright 1.44.1
- playwright-core 1.40.0
- playwright-core 1.44.1
- playwright-core 1.35.1
- playwright-core 1.50.1
- playwright-core 1.30.0