# sanitizer

> Caja's HTML Sanitizer as a Node.js module

Latest version **0.1.3** (published 2015-12-15) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install sanitizer
pnpm add sanitizer
yarn add sanitizer
bun add sanitizer
```

## Health

**Score 18/100 (F)** — status: abandoned.

Positive: has types package; no vulnerabilities.

Warnings: low downloads; no esm support; pre 1.0.

Negative: abandoned; low maintenance score.

## Facts

| | |
|---|---|
| Version | 0.1.3 |
| Published | 2015-12-15 |
| First published | 2012-02-12 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | separate (@types/sanitizer) |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 376 |
| Author | Ben Smawfield |
| Maintainers | thesmaw |

## Links

- npm: https://www.npmjs.com/package/sanitizer
- Repository: https://github.com/theSmaw/Caja-HTML-Sanitizer
- Homepage: http://github.com/theSmaw/Caja-HTML-Sanitizer
- Issues: http://github.com/theSmaw/Caja-HTML-Sanitizer/issues
- npm.io page: https://npm.io/package/sanitizer

## Recent versions

- 0.1.3 (latest) — 2015-12-15
- 0.1.2 — 2014-08-19
- 0.1.1 — 2013-10-19
- 0.1.0 — 2013-10-19
- 0.1.0-alpha — 2013-10-15
- 0.0.1 — 2012-02-12
- 0.0.10 — 2012-02-12
- 0.0.11 — 2012-02-12
- 0.0.12 — 2012-02-12
- 0.0.13 — 2012-02-12
- 0.0.14 — 2012-02-12
- 0.0.2 — 2012-02-12
- 0.0.3 — 2012-02-12
- 0.0.4 — 2012-02-12
- 0.0.5 — 2012-02-12
- … 5 more at https://npm.io/package/sanitizer/versions

## README

## Installation

```
npm install sanitizer
```

## Require

```
var sanitizer = require('sanitizer');
```

## Use

See /test/test-sanitzer.js for full documentation.

```
sanitizer.escape('your dirty string'); // Escapes HTML special characters in attribute values as HTML entities
```

```
var yourParser = sanitizer.makeSaxParser(yourHandler); // Given a SAX-like event handler, produce a function that feeds those events and a parameter to the event handler.
```

```
sanitizer.normalizeRCData('your dirty string'); // Escape entities in RCDATA that can be escaped without changing the meaning.
```

```
sanitizer.sanitize('your dirty string'); // Strips unsafe tags and attributes from html.
```

```
exports.unescapeEntities('your string'); // The plain text of a chunk of HTML CDATA which possibly containing.
```

## Caveats

It's use this at your own risk really - Caja HTML Sanitizer was written by people far cleverer than me. I have just repackaged it to solve a problem I had (sanitization on a Node server). It seems to work, and it passes all its tests in re-packaged form - however I don't fully understand its internals so cannot guarantee its security.


## More information

http://code.google.com/p/google-caja/source/browse/trunk/src/com/google/caja/plugin/html-sanitizer.js

---
_Source: https://npm.io/package/sanitizer · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._