sanitizeUrl js 2024

sanitizeUrl based off Angular which was taken from the closure sanitization library

by Julien Etienne

HTML

<div>TEST</div>

JavaScript

// Example usage:
const htmlInput = `
<div id="main" class="container">
  <p>This is <b>bold</b> text.</p>
  <a href="#" target="_blank" class="link">Click me</a>
  
  "-prompt(8)-"
'-prompt(8)-'
";a=prompt,a()//
';a=prompt,a()//
'-eval("window['pro'%2B'mpt'](8)")-'
"-eval("window['pro'%2B'mpt'](8)")-"
"onclick=prompt(8)>"@x.y
"onclick=prompt(8)><svg/onload=prompt(8)>"@x.y
<image/src/onerror=prompt(8)>
<img/src/onerror=prompt(8)>
<image src/onerror=prompt(8)>
<img src/onerror=prompt(8)>
<image src =q onerror=prompt(8)>
<img src =q onerror=prompt(8)>
</scrip</script>t><img src =q onerror=prompt(8)>
<svg onload=alert(1)>
"><svg onload=alert(1)//
"onmouseover=alert(1)//
"autofocus/onfocus=alert(1)//
'-alert(1)-'
'-alert(1)//
\'-alert(1)//
</script><svg onload=alert(1)>
  
  
</div>
`

document.querySelector('div').textContent = htmlInput