Benchmark: HtmlSanitizer vs DOMPurifier

HTML Preparation code:

<script src="https://cdn.jsdelivr.net/gh/cure53/DOMPurify/dist/purify.js"></script>
<script src="https://unpkg.com/@jitbit/htmlsanitizer@latest/HtmlSanitizer.js"></script>

Script Preparation code:

window.testcontent = `<form id="action_online_form" method="post" action="./../adm/index.php?i=acp_main&amp;sid=534a8e9c03d8251f56daeb0d857cc062&amp;mode=main" data-ajax="true">
				<dl>
					<dt><label for="action_online">Vynulovat rekord uživatelů online</label><br><span class="responsive-hide">&nbsp;</span></dt>
					<dd><input type="hidden" name="action" value="online"><input class="button2" type="submit" id="action_online" name="action_online" value="Spustit nyní"></dd>
				</dl>
			</form>`

Tests:

HtmlSanitizer
var html1 = HtmlSanitizer.SanitizeHtml(window.testcontent);
DOMPurify
var html2 = DOMPurify.sanitize(window.testcontent, {ALLOWED_TAGS: ['b']});

Historical Performance Data aggregated from 19 community runs

Desktop Results:

Chrome 12 runs

HtmlSanitizer

28K/s

DOMPurify

11K/s

Fastest: HtmlSanitizer (2.5x faster)

View exact numbers

✓ HtmlSanitizer: 27,568 ops/sec
• DOMPurify: 11,237 ops/sec

Firefox 7 runs

HtmlSanitizer

22K/s

DOMPurify

6K/s

Fastest: HtmlSanitizer (3.7x faster)

View exact numbers

✓ HtmlSanitizer: 21,815 ops/sec
• DOMPurify: 5,869 ops/sec

Results show median performance across all community submissions. Run this benchmark yourself to verify on your device.

Rendered benchmark preparation results:

Suite status: <idle, ready to run>

Previous results

Test case name	Result
HtmlSanitizer
DOMPurify

Fastest: N/A

Slowest: N/A

Latest run results:

Run details: (Test run date: 5 months ago)

User agent: Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0

Browser/OS: Firefox 140 on Linux

View result in a separate tab

HtmlSanitizer

5K/s

DOMPurify

2K/s

View exact numbers

Test name	Executions per second
✓ HtmlSanitizer	5,121 Ops/sec
DOMPurify	1,790 Ops/sec

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

LLMs can make mistakes. Check important info.

**Benchmark Overview**

MeasureThat.net is a website that allows users to create and run JavaScript microbenchmarks, specifically focusing on HTML sanitization using two popular libraries: DOMPurify and HtmlSanitizer.

**Tested Options**

The benchmark compares the performance of DOMPurify and HtmlSanitizer in sanitizing user input HTML. The options being tested are:

1. **DOMPurify**: A library developed by Curtis Childress that uses a whitelist approach to sanitize HTML, allowing specific tags and attributes while blocking others.
2. **HtmlSanitizer**: An alternative HTML sanitizer library that uses a combination of heuristics and whitelist approaches to detect and remove malicious code.

**Pros and Cons**

### DOMPurify

Pros:

* Highly customizable through its configuration options (e.g., `ALLOWED_TAGS`, `ALLOWED_ATTRS`)
* Supports multiple input formats, including HTML, text, and JSON
* Can be used for general-purpose HTML sanitization

Cons:

* May have higher overhead due to its complex heuristics and regular expressions
* Requires manual tuning of configuration options to achieve optimal performance

### HtmlSanitizer

Pros:

* Simpler and more lightweight compared to DOMPurify
* Provides a more straightforward configuration model through its API
* Still highly customizable with optional flags (e.g., `allowTags`, `allowAttributes`)

Cons:

* May not be as robust or comprehensive as DOMPurify's heuristics
* Less flexible in terms of supported input formats

**Library Description**

1. **DOMPurify**: Developed by Curtis Childress, DOMPurify is a popular and widely-used library for HTML sanitization. Its core philosophy revolves around using a whitelist approach to detect malicious code, allowing specific tags and attributes while blocking others.
2. **HtmlSanitizer**: HtmlSanitizer is an alternative HTML sanitizer library that aims to provide a more streamlined experience compared to DOMPurify. Its API offers optional flags to control the sanitization process, making it easier to customize for specific use cases.

**Special JS Features or Syntax**

None mentioned in the provided benchmark definition. However, keep in mind that JavaScript features like async/await, Promises, and Web Workers can impact benchmark performance.

**Alternatives**

For HTML sanitization, other alternatives include:

1. **JS Sanitizer**: A lightweight library offering a basic sanitization approach.
2. **HTML Saver**: A small library focused on saving the user's input as a sanitized string.
3. **DOMSaver**: Another lightweight library aimed at saving and sanitizing HTML elements.

Please note that the performance differences between these alternatives may vary depending on specific use cases and requirements.

In summary, the benchmark provides an excellent opportunity to compare two widely-used libraries for HTML sanitization: DOMPurify and HtmlSanitizer. By understanding their approaches, pros, and cons, developers can choose the best library for their needs and optimize performance accordingly.

HtmlSanitizer vs DOMPurifier (version: 2) Benchmark.js

Comparing performance of: `HtmlSanitizer vs DOMPurify`

Created: 4 years ago by: Registered User

Go to the latest result

HtmlSanitizer

DOMPurify

Historical Performance Data aggregated from 19 community runs

Desktop Results:

Chrome 12 runs

Firefox 7 runs

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

HtmlSanitizer vs DOMPurifier (version: 2) Benchmark.js

Comparing performance of: HtmlSanitizer vs DOMPurify

Created: 4 years ago by: Registered User

Go to the latest result

HtmlSanitizer

DOMPurify

Historical Performance Data aggregated from 19 community runs

Desktop Results:

Chrome 12 runs

Firefox 7 runs

Suite status: <idle, ready to run>

Fastest: N/A

Slowest: N/A

Autogenerated LLM Summary (model llama3.2:3b, generated one year ago):

Related benchmarks

Comparing performance of: `HtmlSanitizer vs DOMPurify`