![](\"http://shivanshu.ca/myfiles/strip-js-logo.svg\"){kind=logo}
\n\n[![NPM Version][npm-image]][npm-url]\n[![Travis Build][travis-image]][travis-url]\n\nNPM Module which strips out all JavaScript code from some HTML text\n\nThis module performs the following tasks:\n- Sanitizes HTML\n- Removes script tags\n- Removes attributes such as \"onclick\", \"onerror\", etc. which contain JavaScript code\n- Removes \"href\" attributes which contain JavaScript code\n- Removes \"action\" attributes from form tags\n\nAn example use case of this module is to sanitize HTML emails before displaying them in a browser to prevent cross-site scripting attacks.\n\n## Installation\n`npm install strip-js`\n\nThis module can also be used from the command line. Install it globally using the following command:\n\n`sudo npm install -g strip-js`\n\n## Usage\nThe following input HTML ...\n```html\n\n \n \n ![](\"image.gif\")
\n Dangerous Link\n Safe Link\n \n \n This is some text in a p tag, but the p tag is not closed!\n \n\n```\n\n... is converted to the following:\n```html\n\n
\n\n Dangerous Link\n Safe Link\n \n \n This is some text in a p tag, but the p tag is not closed!\n
\n \n\n```\n\nUsing this module is easy!\n```javascript\nvar stripJs = require('strip-js');\nvar fs = require('fs');\nvar html = fs.readFileSync('./webpage.html').toString();\nvar safeHtml = stripJs(html); // It returns plain HTML text\n```\n\nIf you need to preserve doctypes, use `var safeHtml = stripJs(html, { preserveDoctypes: true });`. `preserveDoctypes` defaults to false.\n\nFor command line usage, install it globally. It reads the input HTML from its stdin and outputs the result to stdout.\n```bash\nstrip-js < input.html\n```\n## Warnings\n\nSome old browsers have XSS vulnerabilities in CSS, as mentioned in the browser security handbook:\n> The risk of JavaScript execution. As a little-known feature, some CSS implementations permit JavaScript code to be embedded in stylesheets. There are at least three ways to achieve this goal: by using the expression(...) directive, which gives the ability to evaluate arbitrary JavaScript statements and use their value as a CSS parameter; by using the url('javascript:...') directive on properties that support it; or by invoking browser-specific features such as the -moz-binding mechanism of Firefox.\n\nThis module does not remove any JavaScript from CSS, so it is recommended that you enforce one of the following browsers in your web app:\n- Edge\n- IE11\n- FF3\n- Safari\n- Chrome\n- Android\n\nAll these browsers are safe in that they don't allow JavaScript execution in CSS. Please feel free to add more browsers to this list after testing them, and send a pull request.\n\n[npm-url]: https://www.npmjs.com/package/strip-js\n[npm-image]: https://img.shields.io/npm/v/strip-js.svg?style=flat\n[travis-url]: https://travis-ci.org/shivanshu3/strip-js\n[travis-image]: https://img.shields.io/travis/shivanshu3/strip-js.svg\n","maintainers":[{"name":"shivanshu3","email":"shivanshu3@gmail.com"}],"time":{"modified":"2022-06-27T01:12:28.243Z","created":"2016-10-07T22:06:17.542Z","0.0.1":"2016-10-07T22:06:17.542Z","0.0.2":"2016-10-09T03:36:35.128Z","0.0.3":"2016-10-09T04:58:12.745Z","0.0.5":"2016-10-13T07:09:18.868Z","0.0.6":"2016-10-14T20:21:53.780Z","0.0.7":"2016-10-18T05:58:12.880Z","1.0.0":"2016-10-22T02:48:10.223Z","1.0.1":"2016-11-12T09:20:01.469Z","1.0.2":"2016-11-12T09:23:09.484Z","1.0.3":"2016-11-12T09:24:23.541Z","1.0.4":"2016-12-11T21:52:29.703Z","1.0.5":"2016-12-15T22:53:52.983Z","1.0.6":"2017-01-09T01:51:50.523Z","1.1.0":"2017-12-28T19:43:38.345Z","1.2.0":"2018-02-16T15:40:39.137Z"},"homepage":"https://github.com/shivanshu3/strip-js#readme","repository":{"type":"git","url":"git+https://github.com/shivanshu3/strip-js.git"},"author":{"name":"Shivanshu Goyal"},"bugs":{"url":"https://github.com/shivanshu3/strip-js/issues"},"license":"MIT","readmeFilename":"README.md","keywords":["html","javascript","security","email","cross-site","cross","site","scripting","attack"]}