SO-38418678

by David Thomas

JavaScript

function stripHTML(opts) {
  var settings = {
      'html': null,
      'allowedHTML': ['h2', 'br']
    },
    temp = document.createElement('div'),
    allowedHTML,
    elementNodes,
    parent;

  Object.keys(opts || {}).forEach(function(key) {
    settings[key] = opts[key];
  });

  if (settings.html && 'string' === typeof settings.html) {
    temp.innerHTML = settings.html;
    elementNodes = Array.from(temp.querySelectorAll('*'));

    allowedHTML = settings.allowedHTML.map(function(el) {
      return el.replace(/<|>/g, '');
    });

    elementNodes.forEach(function(node) {
      parent = node.parentNode;
      if (allowedHTML.indexOf(node.localName) === -1) {
        while (node.firstChild) {
          parent.insertBefore(node.firstChild, node);

        }
        parent.removeChild(node);
      }
    });
    return temp.innerHTML.trim();
  }
}

console.log(stripHTML({
  'html': "<script>alert('Will this work?'); console.log('Maybe not?');</" + "script>"
}));