← Back to release summary

Sanitizer API MVP

Category
Security
Type
New or changed feature
Status
In development (Chrome In development)
Intent stage
Evaluate readiness to ship

Summary

The Sanitizer API offers an easy to use and safe by default HTML Sanitizer API, which developers can use to remove content that may execute script from arbitrary, user-supplied HTML content. The goal is to make it easier to build XSS-free web applications. The intended contributions of the Sanitizer API are: Making a sanitizer more easily accessible to web developers; be easy to use and safe by default; and shift part of the maintenance burden to the platform. This is the initial "MVP".

Motivation

User input sanitization is a necessary and common activity of many web applications, but it's difficult to get right. As a component of the web platform it's easier to harden the sanitizer implementation and keep it up-to-date. Offering a high-quality sanitizer with good defaults (without blocking developers from using their own, if they choose) would improve security, and make it more accessible. The original Sanitizer API intent was split in two, this "Sanitizer API MVP" and a future "Sanitizer API". The MVP implements the basic Sanitizer spec, but leaves out the .sanitize and .sanitizeFor methods.

Standards & signals

Docs: https://web.dev/sanitizer https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API

Explainers: https://github.com/WICG/sanitizer-api https://web.dev/sanitizer

View on chromestatus.com