DOMPurify Config Audit

A CONFIG LINTER FOR DOMPURIFY, plus a regression corpus.

DOMPurify is correct by default. Almost every real deployment then CONFIGURES it -- adding an allowed tag, permitting an attribute, turning on a hook -- and a configuration that looks reasonable can re-open exactly what the sanitizer existed to close, with no error and no other signal. This package audits the CONFIG OBJECT you pass to DOMPurify and names what each risky option re-admits.

IT DOES NOT SANITIZE ANYTHING. DOMPurify does that, correctly. Not affiliated with or endorsed by Cure53 or DOMPurify's authors. DOMPurify is a normal peer dependency, never forked, vendored or redistributed; all credit for the sanitizer belongs to its authors.

SCOPE, STATED BEFORE ANYTHING ELSE: this package does not claim to find XSS in DOMPurify and it is not a DOMPurify vulnerability scanner. The failure it addresses is entirely on your side of the boundary -- the allowances a team adds after adoption, each individually defensible, which together reopen a hole. A listing that blurred that line would be selling the wrong assurance.

WHY A CONFIG AUDIT IS THE RIGHT SHAPE. The dangerous options do not look dangerous. Allowing one more tag to make a rich-text editor work, permitting one attribute for a design system, enabling a hook to rewrite links -- each is a small, reviewable diff, and none of them error. The sanitizer keeps reporting success. What changed is what it now lets through, and nothing in the codebase states that.

VERIFIED: 140 tests, measured by running the suite.

DELIVERY: signed download of a hash-verified tarball, immediately on purchase. Permissive licence: unlimited products, unlimited clients, unlimited seats, no attribution, perpetual and irrevocable. One restriction, do not republish the source as source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function auditConfig(config: RawDompurifyConfig): AuditFinding[];
  export function auditOutput(sanitizedOutput: string): AuditFinding[];
  export function audit(config: RawDompurifyConfig, sanitizedOutput?: string): AuditResult;
  export function isKnownOption(key: string): boolean;
  export function scanSanitizedOutput(output: string): AuditFinding[];
  export function ruleUnknownOption(config: RawDompurifyConfig): AuditFinding[];
  export function ruleUriSafeAttrOverride(config: RawDompurifyConfig): AuditFinding[];
  export function ruleUriRegexpWeakened(config: RawDompurifyConfig): AuditFinding[];
  export function ruleUriRegexpNotARegexp(config: RawDompurifyConfig): AuditFinding[];
  export function ruleUnknownProtocolsNoPolicy(config: RawDompurifyConfig): AuditFinding[];
  export function ruleDataAttrNameCollision(config: RawDompurifyConfig): AuditFinding[];
  export function ruleScriptContextTag(config: RawDompurifyConfig): AuditFinding[];

  export type Severity = 'high' | 'medium' | 'info' | 'unknown';
  export type RawDompurifyConfig = Record<string, unknown>;