Benchmark: dompurify@2.3.6 vs js-xss@0.3.3 vs regular render - simple use case

HTML Preparation code:

<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.3.6/purify.min.js" integrity="sha512-DJjvM/U3zCRpzrYboJgg23iLHapWcS2rlo7Ni18Cdv+FMs6b3gUF7hQihztj4uVkHHfUwk7dha97jVzRqUJ7hg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-xss/0.3.3/xss.min.js" integrity="sha512-M9w45qyI/KVHcxTODUsdwWip284UJBj2e6st1Ub6tXXO4nJAP3aIVN2Wkgd15CmJL6eJRFBSUssVyKtZX1v1Fg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Script Preparation code:

window.testcontent = "Here is a string with a <del>strikethrough</del> value"
window.testcontent2 = "Here is a string without a strikethrough value"

Tests:

dompurify
var frag = document.createDocumentFragment(); frag.innerHTML = DOMPurify.sanitize(window.testcontent); document.appendChild(frag);
js-xss
var frag = document.createDocumentFragment(); frag.innerHTML = filterXSS(window.testcontent); document.appendChild(frag);
no sanitization
var frag = document.createDocumentFragment(); frag.innerHTML = window.testcontent2; document.appendChild(frag);

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
dompurify
js-xss
no sanitization

Fastest: N/A

Slowest: N/A

Latest run results:

Run details: (Test run date: 4 months ago)

User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Browser/OS: Chrome 142 on Linux

View result in a separate tab

Test name	Executions per second
dompurify	44546.8 Ops/sec
js-xss	1118334.0 Ops/sec
no sanitization	9768640.0 Ops/sec

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

LLMs can make mistakes. Check important info.

Let's dive into the world of JavaScript microbenchmarks on MeasureThat.net.

The benchmark being tested here is the performance difference between three approaches to prevent Cross-Site Scripting (XSS) attacks:

1. **DOMPurify**: A library that sanitizes input strings by removing any malicious code.
2. **js-xss**: Another library that prevents XSS attacks by filtering out malicious code.
3. **No Sanitization**: Using the raw, unfiltered input string.

**Options Compared**

The three options are compared in terms of their performance, specifically how many executions per second they can achieve on a Chrome 104 browser on a Desktop platform.

**Pros and Cons of Each Approach**

1. **DOMPurify**:
	* Pros: Effective at removing malicious code, widely used and well-maintained.
	* Cons: May introduce additional overhead due to its sanitization process.
2. **js-xss**:
	* Pros: Lightweight and efficient, specifically designed for XSS protection.
	* Cons: May not be as effective as DOMPurify in some cases, as it relies on a filter function that may not catch all malicious code.
3. **No Sanitization**:
	* Pros: Minimal overhead, as it simply uses the raw input string.
	* Cons: Highly vulnerable to XSS attacks, as it leaves the input string unfiltered.

**Library Descriptions**

1. **DOMPurify**: A popular library that provides a simple way to sanitize input strings by removing any malicious code. It's widely used and well-maintained, but may introduce additional overhead due to its sanitization process.
2. **js-xss**: A lightweight library specifically designed for XSS protection. It uses a filter function to remove malicious code from the input string.

**Other Considerations**

When choosing an approach, consider the trade-off between performance, security, and maintenance costs. If you need high-performance and don't mind accepting some risk of XSS attacks, **No Sanitization** might be suitable. However, if you prioritize security and want a reliable solution, **DOMPurify** is generally considered the best choice.

For a more lightweight solution that still provides good protection against XSS attacks, **js-xss** could be an alternative. However, its effectiveness may vary depending on the specific use case and input data.

In summary, the benchmark highlights the importance of choosing the right approach to prevent XSS attacks, balancing performance, security, and maintenance costs.

Related benchmarks:

dompurify@2.3.6 vs js-xss@0.3.3 vs regular render - simple use case (version: 0)

Comparing performance of: dompurify vs js-xss vs no sanitization

Created: 4 years ago by: Guest

Jump to the latest result

dompurify

js-xss

no sanitization

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):