isomorphic-dompurify 2.36.0 → 3.0.0-rc.2

package/README.md

@@ -27,6 +27,7 @@ It was inspired by [Isomorphic Unfetch](https://github.com/developit/unfetch/tre
 | `>=1.10.0`  | `>=18`  | Server  |
 | `>=2.27.0`  | `>=20`  | Server  |
 | `>=2.30.0`  | `>=20.19.5`  | Server  |
+| `>=3.0.0`  | `^20.19.0 \|\| ^22.12.0 \|\| >=24.0.0`  | Server  |
 
 ## Installation
 
@@ -40,21 +41,42 @@ Please note that DOMPurify library [doesn't follow Semantic Versioning](https://
 
 ## Usage
 
-Import:
 ```javascript
 import DOMPurify from "isomorphic-dompurify";
-```
-_Importing the entire module for the client/browser version is recommended._
 
-Sanitize:
-```javascript
 const clean = DOMPurify.sanitize(dirtyString);
 ```
-or with [config](https://github.com/cure53/DOMPurify/blob/main/README.md):
+
+You can pass [config](https://github.com/cure53/DOMPurify/blob/main/README.md) as a second argument:
 ```javascript
 const clean = DOMPurify.sanitize(dirtyString, { USE_PROFILES: { html: true } });
 ```
 
+Named imports are also supported:
+```javascript
+import { sanitize } from "isomorphic-dompurify";
+
+const clean = sanitize(dirtyString);
+```
+
+## Memory Management (Server)
+
+In long-running Node.js processes, the internal jsdom window accumulates DOM state across sanitization calls, which can cause progressive slowdown and memory growth. Use `clearWindow()` to periodically release these resources:
+
+```javascript
+import { sanitize, clearWindow } from "isomorphic-dompurify";
+
+// Sanitize as usual
+const clean = sanitize(dirtyString);
+
+// Release jsdom resources when appropriate (e.g. after a request, after a batch)
+clearWindow();
+```
+
+`clearWindow()` closes the current jsdom window and creates a fresh one. All import styles (default and named) continue to work after calling it.
+
+> **Note:** Any hooks or config set via `addHook`/`setConfig` will need to be re-applied after calling `clearWindow()`. In the browser build, `clearWindow()` is a no-op.
+
 ## Web Worker Support
 
 The `isomorphic-dompurify` library is [compatible with Web Workers](https://github.com/kkomelin/isomorphic-dompurify/pull/242), 

package/dist/browser.d.mts

@@ -0,0 +1,45 @@
+import * as trusted_types_lib from 'trusted-types/lib';
+import * as dompurify from 'dompurify';
+import dompurify__default from 'dompurify';
+export { default } from 'dompurify';
+
+declare const sanitize: {
+    (dirty: string | Node, cfg: dompurify.Config & {
+        RETURN_TRUSTED_TYPE: true;
+    }): trusted_types_lib.TrustedHTML;
+    (dirty: Node, cfg: dompurify.Config & {
+        IN_PLACE: true;
+    }): Node;
+    (dirty: string | Node, cfg: dompurify.Config & {
+        RETURN_DOM: true;
+    }): Node;
+    (dirty: string | Node, cfg: dompurify.Config & {
+        RETURN_DOM_FRAGMENT: true;
+    }): DocumentFragment;
+    (dirty: string | Node, cfg?: dompurify.Config): string;
+};
+declare const isSupported: boolean;
+declare const addHook: {
+    (entryPoint: "beforeSanitizeElements" | "afterSanitizeElements" | "uponSanitizeShadowNode", hookFunction: dompurify.NodeHook): void;
+    (entryPoint: "beforeSanitizeAttributes" | "afterSanitizeAttributes", hookFunction: dompurify.ElementHook): void;
+    (entryPoint: "beforeSanitizeShadowDOM" | "afterSanitizeShadowDOM", hookFunction: dompurify.DocumentFragmentHook): void;
+    (entryPoint: "uponSanitizeElement", hookFunction: dompurify.UponSanitizeElementHook): void;
+    (entryPoint: "uponSanitizeAttribute", hookFunction: dompurify.UponSanitizeAttributeHook): void;
+};
+declare const removeHook: {
+    (entryPoint: "beforeSanitizeElements" | "afterSanitizeElements" | "uponSanitizeShadowNode", hookFunction?: dompurify.NodeHook): dompurify.NodeHook | undefined;
+    (entryPoint: "beforeSanitizeAttributes" | "afterSanitizeAttributes", hookFunction?: dompurify.ElementHook): dompurify.ElementHook | undefined;
+    (entryPoint: "beforeSanitizeShadowDOM" | "afterSanitizeShadowDOM", hookFunction?: dompurify.DocumentFragmentHook): dompurify.DocumentFragmentHook | undefined;
+    (entryPoint: "uponSanitizeElement", hookFunction?: dompurify.UponSanitizeElementHook): dompurify.UponSanitizeElementHook | undefined;
+    (entryPoint: "uponSanitizeAttribute", hookFunction?: dompurify.UponSanitizeAttributeHook): dompurify.UponSanitizeAttributeHook | undefined;
+};
+declare const removeHooks: (entryPoint: dompurify.HookName) => void;
+declare const removeAllHooks: () => void;
+declare const setConfig: (cfg?: dompurify.Config) => void;
+declare const clearConfig: () => void;
+declare const isValidAttribute: (tag: string, attr: string, value: string) => boolean;
+declare const version: string;
+declare const removed: (dompurify.RemovedElement | dompurify.RemovedAttribute)[];
+declare function clearWindow(): void;
+
+export { addHook, clearConfig, clearWindow, isSupported, isValidAttribute, removeAllHooks, removeHook, removeHooks, removed, sanitize, setConfig, version };

package/dist/browser.d.ts

@@ -0,0 +1,45 @@
+import * as trusted_types_lib from 'trusted-types/lib';
+import * as dompurify from 'dompurify';
+import dompurify__default from 'dompurify';
+export { default } from 'dompurify';
+
+declare const sanitize: {
+    (dirty: string | Node, cfg: dompurify.Config & {
+        RETURN_TRUSTED_TYPE: true;
+    }): trusted_types_lib.TrustedHTML;
+    (dirty: Node, cfg: dompurify.Config & {
+        IN_PLACE: true;
+    }): Node;
+    (dirty: string | Node, cfg: dompurify.Config & {
+        RETURN_DOM: true;
+    }): Node;
+    (dirty: string | Node, cfg: dompurify.Config & {
+        RETURN_DOM_FRAGMENT: true;
+    }): DocumentFragment;
+    (dirty: string | Node, cfg?: dompurify.Config): string;
+};
+declare const isSupported: boolean;
+declare const addHook: {
+    (entryPoint: "beforeSanitizeElements" | "afterSanitizeElements" | "uponSanitizeShadowNode", hookFunction: dompurify.NodeHook): void;
+    (entryPoint: "beforeSanitizeAttributes" | "afterSanitizeAttributes", hookFunction: dompurify.ElementHook): void;
+    (entryPoint: "beforeSanitizeShadowDOM" | "afterSanitizeShadowDOM", hookFunction: dompurify.DocumentFragmentHook): void;
+    (entryPoint: "uponSanitizeElement", hookFunction: dompurify.UponSanitizeElementHook): void;
+    (entryPoint: "uponSanitizeAttribute", hookFunction: dompurify.UponSanitizeAttributeHook): void;
+};
+declare const removeHook: {
+    (entryPoint: "beforeSanitizeElements" | "afterSanitizeElements" | "uponSanitizeShadowNode", hookFunction?: dompurify.NodeHook): dompurify.NodeHook | undefined;
+    (entryPoint: "beforeSanitizeAttributes" | "afterSanitizeAttributes", hookFunction?: dompurify.ElementHook): dompurify.ElementHook | undefined;
+    (entryPoint: "beforeSanitizeShadowDOM" | "afterSanitizeShadowDOM", hookFunction?: dompurify.DocumentFragmentHook): dompurify.DocumentFragmentHook | undefined;
+    (entryPoint: "uponSanitizeElement", hookFunction?: dompurify.UponSanitizeElementHook): dompurify.UponSanitizeElementHook | undefined;
+    (entryPoint: "uponSanitizeAttribute", hookFunction?: dompurify.UponSanitizeAttributeHook): dompurify.UponSanitizeAttributeHook | undefined;
+};
+declare const removeHooks: (entryPoint: dompurify.HookName) => void;
+declare const removeAllHooks: () => void;
+declare const setConfig: (cfg?: dompurify.Config) => void;
+declare const clearConfig: () => void;
+declare const isValidAttribute: (tag: string, attr: string, value: string) => boolean;
+declare const version: string;
+declare const removed: (dompurify.RemovedElement | dompurify.RemovedAttribute)[];
+declare function clearWindow(): void;
+
+export { addHook, clearConfig, clearWindow, isSupported, isValidAttribute, removeAllHooks, removeHook, removeHooks, removed, sanitize, setConfig, version };

package/dist/browser.js

@@ -0,0 +1,77 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/browser.ts
+var browser_exports = {};
+__export(browser_exports, {
+  addHook: () => addHook,
+  clearConfig: () => clearConfig,
+  clearWindow: () => clearWindow,
+  default: () => browser_default,
+  isSupported: () => isSupported,
+  isValidAttribute: () => isValidAttribute,
+  removeAllHooks: () => removeAllHooks,
+  removeHook: () => removeHook,
+  removeHooks: () => removeHooks,
+  removed: () => removed,
+  sanitize: () => sanitize,
+  setConfig: () => setConfig,
+  version: () => version
+});
+module.exports = __toCommonJS(browser_exports);
+var import_dompurify = __toESM(require("dompurify"));
+var browser_default = import_dompurify.default;
+var sanitize = import_dompurify.default.sanitize.bind(import_dompurify.default);
+var isSupported = import_dompurify.default.isSupported;
+var addHook = import_dompurify.default.addHook.bind(import_dompurify.default);
+var removeHook = import_dompurify.default.removeHook.bind(import_dompurify.default);
+var removeHooks = import_dompurify.default.removeHooks.bind(import_dompurify.default);
+var removeAllHooks = import_dompurify.default.removeAllHooks.bind(import_dompurify.default);
+var setConfig = import_dompurify.default.setConfig.bind(import_dompurify.default);
+var clearConfig = import_dompurify.default.clearConfig.bind(import_dompurify.default);
+var isValidAttribute = import_dompurify.default.isValidAttribute.bind(import_dompurify.default);
+var version = import_dompurify.default.version;
+var removed = import_dompurify.default.removed;
+function clearWindow() {
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  addHook,
+  clearConfig,
+  clearWindow,
+  isSupported,
+  isValidAttribute,
+  removeAllHooks,
+  removeHook,
+  removeHooks,
+  removed,
+  sanitize,
+  setConfig,
+  version
+});

package/dist/browser.mjs

@@ -0,0 +1,31 @@
+// src/browser.ts
+import DOMPurify from "dompurify";
+var browser_default = DOMPurify;
+var sanitize = DOMPurify.sanitize.bind(DOMPurify);
+var isSupported = DOMPurify.isSupported;
+var addHook = DOMPurify.addHook.bind(DOMPurify);
+var removeHook = DOMPurify.removeHook.bind(DOMPurify);
+var removeHooks = DOMPurify.removeHooks.bind(DOMPurify);
+var removeAllHooks = DOMPurify.removeAllHooks.bind(DOMPurify);
+var setConfig = DOMPurify.setConfig.bind(DOMPurify);
+var clearConfig = DOMPurify.clearConfig.bind(DOMPurify);
+var isValidAttribute = DOMPurify.isValidAttribute.bind(DOMPurify);
+var version = DOMPurify.version;
+var removed = DOMPurify.removed;
+function clearWindow() {
+}
+export {
+  addHook,
+  clearConfig,
+  clearWindow,
+  browser_default as default,
+  isSupported,
+  isValidAttribute,
+  removeAllHooks,
+  removeHook,
+  removeHooks,
+  removed,
+  sanitize,
+  setConfig,
+  version
+};

package/dist/index.d.mts

@@ -0,0 +1,19 @@
+import * as dompurify from 'dompurify';
+import { DOMPurify as DOMPurify$1 } from 'dompurify';
+
+declare const DOMPurify: DOMPurify$1;
+
+declare const sanitize: DOMPurify$1["sanitize"];
+declare const isSupported: boolean;
+declare const addHook: DOMPurify$1["addHook"];
+declare const removeHook: DOMPurify$1["removeHook"];
+declare const removeHooks: DOMPurify$1["removeHooks"];
+declare const removeAllHooks: DOMPurify$1["removeAllHooks"];
+declare const setConfig: DOMPurify$1["setConfig"];
+declare const clearConfig: DOMPurify$1["clearConfig"];
+declare const isValidAttribute: DOMPurify$1["isValidAttribute"];
+declare const version: string;
+declare const removed: (dompurify.RemovedElement | dompurify.RemovedAttribute)[];
+declare function clearWindow(): void;
+
+export { addHook, clearConfig, clearWindow, DOMPurify as default, isSupported, isValidAttribute, removeAllHooks, removeHook, removeHooks, removed, sanitize, setConfig, version };

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+import * as dompurify from 'dompurify';
+import { DOMPurify as DOMPurify$1 } from 'dompurify';
+
+declare const DOMPurify: DOMPurify$1;
+
+declare const sanitize: DOMPurify$1["sanitize"];
+declare const isSupported: boolean;
+declare const addHook: DOMPurify$1["addHook"];
+declare const removeHook: DOMPurify$1["removeHook"];
+declare const removeHooks: DOMPurify$1["removeHooks"];
+declare const removeAllHooks: DOMPurify$1["removeAllHooks"];
+declare const setConfig: DOMPurify$1["setConfig"];
+declare const clearConfig: DOMPurify$1["clearConfig"];
+declare const isValidAttribute: DOMPurify$1["isValidAttribute"];
+declare const version: string;
+declare const removed: (dompurify.RemovedElement | dompurify.RemovedAttribute)[];
+declare function clearWindow(): void;
+
+export { addHook, clearConfig, clearWindow, DOMPurify as default, isSupported, isValidAttribute, removeAllHooks, removeHook, removeHooks, removed, sanitize, setConfig, version };

package/dist/index.js

@@ -0,0 +1,89 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var src_exports = {};
+__export(src_exports, {
+  addHook: () => addHook,
+  clearConfig: () => clearConfig,
+  clearWindow: () => clearWindow,
+  default: () => src_default,
+  isSupported: () => isSupported,
+  isValidAttribute: () => isValidAttribute,
+  removeAllHooks: () => removeAllHooks,
+  removeHook: () => removeHook,
+  removeHooks: () => removeHooks,
+  removed: () => removed,
+  sanitize: () => sanitize,
+  setConfig: () => setConfig,
+  version: () => version
+});
+module.exports = __toCommonJS(src_exports);
+var import_dompurify = __toESM(require("dompurify"));
+var import_jsdom = require("jsdom");
+var window = new import_jsdom.JSDOM("<!DOCTYPE html>").window;
+var purify = (0, import_dompurify.default)(window);
+var DOMPurify = new Proxy({}, {
+  get(_, prop) {
+    const value = purify[prop];
+    return typeof value === "function" ? value.bind(purify) : value;
+  }
+});
+var src_default = DOMPurify;
+var sanitize = ((dirty, config) => purify.sanitize(dirty, config));
+var isSupported = DOMPurify.isSupported;
+var addHook = ((entryPoint, hookFunction) => purify.addHook(entryPoint, hookFunction));
+var removeHook = ((entryPoint) => purify.removeHook(entryPoint));
+var removeHooks = ((entryPoint) => purify.removeHooks(entryPoint));
+var removeAllHooks = (() => purify.removeAllHooks());
+var setConfig = ((config) => purify.setConfig(config));
+var clearConfig = (() => purify.clearConfig());
+var isValidAttribute = ((tag, attr, value) => purify.isValidAttribute(tag, attr, value));
+var version = DOMPurify.version;
+var removed = DOMPurify.removed;
+function clearWindow() {
+  window.close();
+  window = new import_jsdom.JSDOM("<!DOCTYPE html>").window;
+  purify = (0, import_dompurify.default)(window);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  addHook,
+  clearConfig,
+  clearWindow,
+  isSupported,
+  isValidAttribute,
+  removeAllHooks,
+  removeHook,
+  removeHooks,
+  removed,
+  sanitize,
+  setConfig,
+  version
+});

package/dist/index.mjs

@@ -0,0 +1,43 @@
+// src/index.ts
+import DOMPurifyFactory from "dompurify";
+import { JSDOM } from "jsdom";
+var window = new JSDOM("<!DOCTYPE html>").window;
+var purify = DOMPurifyFactory(window);
+var DOMPurify = new Proxy({}, {
+  get(_, prop) {
+    const value = purify[prop];
+    return typeof value === "function" ? value.bind(purify) : value;
+  }
+});
+var src_default = DOMPurify;
+var sanitize = ((dirty, config) => purify.sanitize(dirty, config));
+var isSupported = DOMPurify.isSupported;
+var addHook = ((entryPoint, hookFunction) => purify.addHook(entryPoint, hookFunction));
+var removeHook = ((entryPoint) => purify.removeHook(entryPoint));
+var removeHooks = ((entryPoint) => purify.removeHooks(entryPoint));
+var removeAllHooks = (() => purify.removeAllHooks());
+var setConfig = ((config) => purify.setConfig(config));
+var clearConfig = (() => purify.clearConfig());
+var isValidAttribute = ((tag, attr, value) => purify.isValidAttribute(tag, attr, value));
+var version = DOMPurify.version;
+var removed = DOMPurify.removed;
+function clearWindow() {
+  window.close();
+  window = new JSDOM("<!DOCTYPE html>").window;
+  purify = DOMPurifyFactory(window);
+}
+export {
+  addHook,
+  clearConfig,
+  clearWindow,
+  src_default as default,
+  isSupported,
+  isValidAttribute,
+  removeAllHooks,
+  removeHook,
+  removeHooks,
+  removed,
+  sanitize,
+  setConfig,
+  version
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "isomorphic-dompurify",
-  "version": "2.36.0",
+  "version": "3.0.0-rc.2",
   "description": "Makes it possible to use DOMPurify on server and client in the same way.",
   "keywords": [
     "security",
@@ -20,25 +20,39 @@
     "url": "https://github.com/kkomelin/isomorphic-dompurify/issues"
   },
   "files": [
-    "index.js",
-    "index.d.ts",
-    "browser.js"
+    "dist"
   ],
   "license": "MIT",
   "repository": "kkomelin/isomorphic-dompurify",
-  "browser": "browser.js",
-  "main": "index.js",
-  "types": "index.d.ts",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "browser": {
+    "./dist/index.js": "./dist/browser.js",
+    "./dist/index.mjs": "./dist/browser.mjs"
+  },
   "exports": {
-    "node": {
-      "types": "./index.d.ts",
-      "import": "./index.js",
-      "require": "./index.js"
-    },
-    "default": {
-      "types": "./index.d.ts",
-      "import": "./browser.js",
-      "require": "./browser.js"
+    ".": {
+      "node": {
+        "import": {
+          "types": "./dist/index.d.mts",
+          "default": "./dist/index.mjs"
+        },
+        "require": {
+          "types": "./dist/index.d.ts",
+          "default": "./dist/index.js"
+        }
+      },
+      "default": {
+        "import": {
+          "types": "./dist/browser.d.mts",
+          "default": "./dist/browser.mjs"
+        },
+        "require": {
+          "types": "./dist/browser.d.ts",
+          "default": "./dist/browser.js"
+        }
+      }
     }
   },
   "dependencies": {
@@ -46,14 +60,17 @@
     "jsdom": "^28.0.0"
   },
   "devDependencies": {
-    "terser": "^5.44.1",
+    "@types/jsdom": "^27.0.0",
+    "@types/trusted-types": "^2.0.7",
+    "tsup": "^8.5.1",
+    "typescript": "^5.9.3",
     "vitest": "^4.0.16"
   },
   "engines": {
-    "node": ">=20.19.5"
+    "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
   },
   "scripts": {
-    "test": "vitest run",
-    "build": "terser src/index.js --compress --mangle --module -o index.js"
+    "build": "tsup",
+    "test": "NODE_OPTIONS='--expose-gc' vitest run"
   }
 }

package/browser.js

@@ -1 +0,0 @@
-module.exports = self.DOMPurify || (self.DOMPurify = require('dompurify').default || require('dompurify'));

package/index.d.ts

@@ -1,2 +0,0 @@
-import * as DOMPurify from 'dompurify';
-export = DOMPurify

package/index.js

@@ -1 +0,0 @@
-function e(e){return e&&e.default||e}module.exports=global.DOMPurify=global.DOMPurify||("undefined"!=typeof window?e(require("dompurify")):function(){const r=e(require("dompurify")),{JSDOM:u}=e(require("jsdom")),{window:o}=new u("<!DOCTYPE html>");return r(o)}());