neosanitize
Zero-dependency, isomorphic HTML sanitizer in TypeScript. **Two engines in one package:**
- **`.` (main)** — a new, forward-looking engine built on a **browser-faithful WHATWG parser** (100% [html5lib](https://github.com/html5lib/html5lib-tests) tokenizer conformance), **deny-by-default** policy, and an **inviolable safe baseline**. Roughly **2.3× faster** than `sanitize-html` across a 13-scenario benchmark.
- **`./legacy`** — a byte-identical, drop-in port of [`sanitize-html`](https://github.com/apostrophecms/sanitize-html) 2.x: same API, same output, verified against the original with millions of differential-fuzz cases. Use it to migrate off `sanitize-html` (and its `htmlparser2` + `postcss` dependency tree) with no behaviour change.
No runtime dependencies. ESM. `sideEffects: false` and subpath exports — you ship only what you import.
```bash
npm install neosanitize
```
---
## Which engine should I use?
| | `.` (main) | `./legacy` |
|---|---|---|
| **Use when** | new code; you want speed, a browser-faithful parse, and deny-by-default safety | dropping in for an existing `sanitize-html` install with zero behaviour change |
| **Parser** | own WHATWG/HTML5 parser (matches the browser) | `htmlparser2` semantics (matches `sanitize-html`) |
| **API** | class-only: build a `Sanitizer`, call `.sanitize()` | functional: `sanitize(html, options)` |
| **Default posture** | deny-by-default + inviolable baseline | identical to `sanitize-html` |
| **Stability** | evolves (semver) | frozen to `sanitize-html`'s behaviour |
The two share **no runtime code** — importing one never pulls in the other.
---
## Quick start — the main engine
The main engine is **class-only by design**. You build a `Sanitizer` with an explicit policy and call `.sanitize()`. There is deliberately **no** one-shot `sanitize(html)` helper: forcing an explicit policy means there's no implicit global default to misconfigure, and the policy is compiled **once** so repeated `.sanitize()` calls are cheap.
```ts
import { Sanitizer } from 'neosanitize';
import * as presets from 'neosanitize/presets';
// Build once (compiles the policy), reuse everywhere.
const sanitizer = Sanitizer.builder(presets.ugc).allow('img', ['src', 'alt']).build();
sanitizer.sanitize('hi 
');
// → 'hi
'
// onerror handler stripped,