Sanitizer API

The Document.parseHTML() static method and the setHTML() method of Element and ShadowRoot objects parse and insert HTML into the DOM in a way that can prevent cross-site scripting attacks. The Sanitizer API can customize the sanitization process.

Baseline Status: This feature is currently Limited and is missing in at least one major browser engine.

Desktop Browser Engine Support

Google Chrome

146

Supported

Mozilla Firefox

148

Supported

Apple Safari

—

Unsupported

Microsoft Edge

146

Supported

Mobile Browser Engine Support

Chrome Android

146

Firefox Android

148

Safari iOS

—

Specifications and References

Specification ↗ Feature XML ↗

MDN Browser Compat Data Keys:

api.Document.parseHTML_static ↗ api.Element.setHTML ↗ api.Sanitizer ↗ api.Sanitizer.Sanitizer ↗ api.Sanitizer.allowAttribute ↗ api.Sanitizer.allowElement ↗ api.Sanitizer.get ↗ api.Sanitizer.removeAttribute ↗ api.Sanitizer.removeElement ↗ api.Sanitizer.removeUnsafe ↗ api.Sanitizer.replaceElementWithChildren ↗ api.Sanitizer.setComments ↗ api.Sanitizer.setDataAttributes ↗ api.ShadowRoot.setHTML ↗