Back to all features
Open for signals
Sanitizer API
The Document.parseHTML() static method and the setHTML() method of Element and ShadowRoot objects parse and insert HTML into the DOM in a way that can prevent cross-site scripting attacks. The Sanitizer API can customize the sanitization process.
Community use cases (2)
Community signal summary
Developers are advocating for native browser support for the
sanitizerAPI to securely parse and render untrusted, user-supplied HTML directly within the platform [1]. Primary use cases include sanitizing dynamic client-side markup in privacy-focused applications like zero-knowledge pastebins [1] and reliably filtering user content across enterprise web applications [2].In the interim, developers are forced to bundle and maintain third-party JavaScript libraries like
DOMPurifyto inspect markup before rendering [1][2]. An engineer at Microsoft Corporation noted that while existing client-side libraries function, they impose noticeable bundle size overhead compared to native engine implementations [2]. Teams also face an ongoing maintenance burden to keep external sanitization dependencies continually updated against emerging XSS vulnerabilities and security regressions [1].Generated by AI from community comments and may contain inaccuracies. Read the comments below for full developer context.
This summary covers all 2 comments, is up to date, and was last updated on September 9, 2026.
What I want to do with this feature
Sanitizing user HTML, e.g. for https://privatebin.net/
What I'm having to do in the meantime
Embed and maintain (aka keep updated etc.)/integrate an external library aka DOMPurify: https://github.com/cure53/DOMPurify/
What I want to do with this feature
I need to reliably santize HTML content client side.
What I'm having to do in the meantime
Use DOMPurify to get these features. DOMPurify works fine but it's not the lightest library, particularly when compared with something built into the platform.