Interesting. Any kind of sanitizer like this seems doomed to fail repeatedly--I like the discussion at http://langsec.org/ http://langsec.org/ I wrote a Semgre

Interesting. Any kind of sanitizer like this seems doomed to fail repeatedly--I like the discussion at http://langsec.org/ http://langsec.org/ I wrote a Semgrep rule (I'm one of the maintainers) to look for calls to the .sanitize() method and suggest the final recommendation in the post, which is to use either RETURN_DOM or RETURN_DOM_FRAGMENT. To use it: pip install semgrep && semgrep --config=https://semgrep.dev/s/ievans:dom-purify2 Or you can just preview it on some test code: https://semgrep.dev/s/ievans:dom-purify2 https://semgrep.dev/s/ievans:dom-purify2