text-sanitize-html Edge Function — Content

text-sanitize-html — Sanitize HTML Against XSS

Sanitizes HTML by stripping dangerous tags, event handlers, and unsafe URLs. Keeps only explicitly allowed tags and attributes to prevent XSS attacks.

---

API

POST /api/text-sanitize-html

Request body

Field	Type	Required	Default	Description
html	string	✅	—	The HTML string to sanitize
allowTags	string[]	❌	See below	Tags to keep in output
allowAttributes	Record<string, string[]>	❌	{ a: ['href','title','target'] }	Allowed attributes per tag
stripComments	boolean	❌	true	Remove HTML comments

Default allowed tags: p, br, strong, em, a, ul, ol, li, code, pre, blockquote, h1–h6

Always stripped (regardless of allowTags): script, style, iframe, object, embed, form, input, button

Always stripped attributes: any attribute starting with on (e.g. onclick, onerror, onload)

Always stripped URL schemes: javascript: and data: in href/src attributes

Success response (200)

{
  "success": true,
  "data": {
    "html": "<p>Hello <strong>world</strong>.</p>",
    "strippedTagCount": 3
  }
}

Error responses

Code	HTTP	When
INVALID_INPUT	400	Missing or invalid html field
INTERNAL_ERROR	500	Unexpected processing error

---

Usage

cURL

curl -X POST "$FUNCTION_URL/api/text-sanitize-html" \
  -H "Content-Type: application/json" \
  -d '{
    "html": "<p onclick=\"alert(1)\">Hello <script>evil()</script> World</p>",
    "allowTags": ["p", "strong", "em"],
    "allowAttributes": {}
  }'

TypeScript / JavaScript (HTTP)

const response = await fetch(`${FUNCTION_URL}/api/text-sanitize-html`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({
    html: userProvidedHtml,
    allowTags: ['p', 'strong', 'em', 'a', 'ul', 'ol', 'li'],
    allowAttributes: { a: ['href', 'title'] },
    stripComments: true,
  }),
});
const { data } = await response.json();
console.log(data.html);           // safe HTML
console.log(data.strippedTagCount); // number of removed tags

Direct import (Node / Bun / Deno)

import { sanitizeHtml } from '@aerostack/functions/text-sanitize-html';

const result = sanitizeHtml({
  html: '<div><p>Safe content.</p><script>alert(1)</script></div>',
});
console.log(result.html);           // <p>Safe content.</p>
console.log(result.strippedTagCount); // 3 (div, script, /div)

---

Use Cases

• User-generated content: Sanitize comments, forum posts, or profile bios that contain HTML before storing or rendering.
• AI-generated HTML: Clean up HTML produced by LLMs before injecting it into a web page to ensure no accidental XSS vectors.
• Email body validation: Strip dangerous elements from HTML emails before storing or forwarding.
• Rich text editor output: Process output from WYSIWYG editors (TipTap, ProseMirror, Quill) before saving to a database.

---

Notes

• script, style, iframe, object, embed, form, input, and button are always removed and cannot be added to allowTags.
• All on* attributes (e.g. onclick, onerror, onload) are always removed regardless of allowAttributes.
• javascript: and data: URL schemes in href/src are always removed.
• Text content inside stripped tags is preserved (e.g. <div>text</div> → text). Exception: script and style content is removed entirely.