Run results for: dompurify@2.3.6 vs js-xss@0.3.3 vs regular render - simple use case

Run details:

User agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36

Browser: Chrome 142

Operating system: Linux

Device Platform: Desktop

Date tested: 9 months ago

Benchmark engine: Benchmark.js

no sanitization

9.8M/s

js-xss

1.1M/s

dompurify

45K/s

View exact numbers

Test name	Executions per second
✓ no sanitization	9,768,640 Ops/sec
js-xss	1,118,334 Ops/sec
dompurify	44,547 Ops/sec

HTML Preparation code:

<script src="https://cdnjs.cloudflare.com/ajax/libs/dompurify/2.3.6/purify.min.js" integrity="sha512-DJjvM/U3zCRpzrYboJgg23iLHapWcS2rlo7Ni18Cdv+FMs6b3gUF7hQihztj4uVkHHfUwk7dha97jVzRqUJ7hg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/js-xss/0.3.3/xss.min.js" integrity="sha512-M9w45qyI/KVHcxTODUsdwWip284UJBj2e6st1Ub6tXXO4nJAP3aIVN2Wkgd15CmJL6eJRFBSUssVyKtZX1v1Fg==" crossorigin="anonymous" referrerpolicy="no-referrer"></script>

Script Preparation code:

window.testcontent = "Here is a string with a <del>strikethrough</del> value"
window.testcontent2 = "Here is a string without a strikethrough value"

Tests:

dompurify
var frag = document.createDocumentFragment(); frag.innerHTML = DOMPurify.sanitize(window.testcontent); document.appendChild(frag);
js-xss
var frag = document.createDocumentFragment(); frag.innerHTML = filterXSS(window.testcontent); document.appendChild(frag);
no sanitization
var frag = document.createDocumentFragment(); frag.innerHTML = window.testcontent2; document.appendChild(frag);