← Back to release summary

Sanitizer API

Category
Security
Type
New or changed feature
Status
Enabled by default (Chrome 146)
Intent stage
None

Summary

The Sanitizer API offers an easy to use and safe by default HTML Sanitizer API, which developers can use to remove content that may execute script from arbitrary, user-supplied HTML content. The goal is to make it easier to build XSS-free web applications. This follows previous attempts at establishing a Sanitizer API (https://chromestatus.com/feature/5786893650231296), which we unshipped again (https://chromestatus.com/feature/5115076981293056). The specification has meanwhile progressed and now has widespread support.

Motivation

User input sanitization is a necessary and common activity of many web applications, but it's difficult to get right. As a component of the web platform it's easier to harden the sanitizer implementation and keep it up-to-date. Offering a high-quality sanitizer with good defaults (without blocking developers from using their own, if they choose) would improve security, and make it more accessible.

Standards & signals

Samples: https://developer.mozilla.org/en-US/docs/Web/API/HTML_Sanitizer_API https://sanitizer-api.dev

Explainers: https://github.com/WICG/sanitizer-api/blob/main/explainer.md

View on chromestatus.com