Benchmark: Dompurify vs sanitize-html

HTML Preparation code:

<script src="https://cdnjs.cloudflare.com/ajax/libs/sanitize-html/1.27.5/sanitize-html.min.js"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.2.7/purify.min.js"></script>

Tests:

DOMPurify
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> ` const result = DOMPurify.sanitize(testString)
Sanitize HTML
const testString = ` Welcome to safeland <a href='javascript:alert(1)'>This is fun</a> <img src=x onerror=console.log(1)> ` const result = sanitizeHtml(testString)

Historical Performance Data aggregated from 313 community runs

Desktop Results:

Chrome 250 runs

Sanitize HTML

98K/s

DOMPurify

23K/s

Fastest: Sanitize HTML (4.2x faster)

View exact numbers

✓ Sanitize HTML: 98,034 ops/sec
• DOMPurify: 23,105 ops/sec

Firefox 45 runs

Sanitize HTML

53K/s

DOMPurify

12K/s

Fastest: Sanitize HTML (4.6x faster)

View exact numbers

✓ Sanitize HTML: 53,458 ops/sec
• DOMPurify: 11,518 ops/sec

Safari 11 runs

Sanitize HTML

208K/s

DOMPurify

30K/s

Fastest: Sanitize HTML (7.0x faster)

View exact numbers

✓ Sanitize HTML: 208,371 ops/sec
• DOMPurify: 29,817 ops/sec

Mobile Results:

Chrome 7 runs

Sanitize HTML

31K/s

DOMPurify

3K/s

Fastest: Sanitize HTML (9.4x faster)

View exact numbers

✓ Sanitize HTML: 31,432 ops/sec
• DOMPurify: 3,343 ops/sec

Results show median performance across all community submissions. Run this benchmark yourself to verify on your device.

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
DOMPurify
Sanitize HTML

Fastest: N/A

Slowest: N/A

Latest run results:

Run details: (Test run date: 7 months ago)

User agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36

Browser/OS: Chrome 143 on Mac OS X 10.15.7

View result in a separate tab

Sanitize HTML

190K/s

DOMPurify

51K/s

View exact numbers

Test name	Executions per second
✓ Sanitize HTML	189,513 Ops/sec
DOMPurify	50,720 Ops/sec

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

LLMs can make mistakes. Check important info.

**Benchmark Overview**

MeasureThat.net is a platform that allows users to create and run JavaScript microbenchmarks. The provided benchmark compares the performance of two popular libraries: DOMPurify and sanitize-html.

**Library Descriptions**

1. **DOMPurify**: DOMPurify is a library that helps remove malicious content from HTML strings, making it safer for consumption by web browsers. It provides a simple API to sanitize user-generated content.
2. **sanitize-html**: sanitize-html is another popular library for sanitizing HTML content. It offers more advanced features than DOMPurify, including support for custom whitelisting and blacklisting of tags, attributes, and values.

**Comparison of Options**

The benchmark compares the performance of two options:

1. **DOMPurify vs Sanitize HTML**: The two libraries have different approaches to sanitizing HTML content.
	* **DOMPurify**: Uses a simple, rules-based approach to remove malicious tags and attributes from the input string.
	* **Sanitize HTML**: Employs a more advanced approach that uses regular expressions and custom whitelisting/blacklisting to sanitize the input string.

**Pros and Cons of Each Approach**

1. **DOMPurify**:
	* Pros:
		+ Simple, lightweight implementation
		+ Fast execution times
	* Cons:
		+ May not catch all malicious content (e.g., JavaScript injections)
2. **Sanitize HTML**:
	* Pros:
		+ More comprehensive sanitization capabilities
		+ Customizable whitelisting/blacklisting
	* Cons:
		+ Heavier implementation compared to DOMPurify
		+ May have slower execution times

**Special JS Features/Syntax**

In this benchmark, the test users special JavaScript features/syntax:

1. **JavaScript:alert(1)**: Used in the `onerror` attribute of an image tag.
2. **\r\n**: Used to create a newline character in the input string.

**Other Considerations**

* The benchmark uses Chrome 129 as the test browser, which may affect the results due to its version-specific features and performance characteristics.
* The device platform is specified as Desktop, but the results are not explicitly verified for desktop vs. mobile devices.

**Alternatives**

If you're interested in exploring alternative libraries or approaches for sanitizing HTML content, some popular options include:

1. **Cheerio**: A lightweight jQuery-like library for parsing and manipulating HTML documents.
2. **DOMParser**: A native JavaScript API for parsing and transforming HTML documents.
3. **HTML Sanitizer by WAPForce**: Another commercial-grade HTML sanitizer that offers advanced features and customization options.

Note that the choice of library or approach depends on your specific use case, performance requirements, and level of control over sanitization logic.

Dompurify vs sanitize-html (version: 0)

Comparing performance of: `DOMPurify vs Sanitize HTML`

Created: 5 years ago by: Guest

Go to the latest result

DOMPurify

Sanitize HTML

Historical Performance Data aggregated from 313 community runs

Desktop Results:

Chrome 250 runs

Firefox 45 runs

Safari 11 runs

Mobile Results:

Chrome 7 runs

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

Dompurify vs sanitize-html (version: 0)

Comparing performance of: DOMPurify vs Sanitize HTML

Created: 5 years ago by: Guest

Go to the latest result

DOMPurify

Sanitize HTML

Historical Performance Data aggregated from 313 community runs

Desktop Results:

Chrome 250 runs

Firefox 45 runs

Safari 11 runs

Mobile Results:

Chrome 7 runs

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

Related benchmarks

Comparing performance of: `DOMPurify vs Sanitize HTML`