purifai 2.0.1 → 2.0.2

package/README.md

@@ -21,22 +21,36 @@ such as `<b>` and `<a href>`. That is a harder problem and they solve it well.
 
 ## 🏆 Benchmark Results
 
-Produced by `pnpm test:fair`. Each sanitizer's output is inserted into a real DOM
+Produced by `pnpm benchmark`. Each tool's output is inserted into a real DOM
 (jsdom), then serialized and re-parsed — the round trip where mutation XSS lives.
 A vector counts as blocked only if *neither* parse yields a script node, an `on*`
-handler, or a dangerous-protocol URL.
-
-| Library | Category | Security | Text kept | Markup kept |
-|---------|----------|----------|-----------|-------------|
-| **Purifai** | strip-to-text | **100%** | **100%** | 0% *(by design)* |
-| DOMPurify | preserve-html | 100% | 100% | 100% |
-| sanitize-html | preserve-html | 100% | 100% | 100% |
-| xss | preserve-html | 100% | 100% | 100% |
-| `() => ''` *(calibration)* | — | 100% | 0% | 0% |
-| `v => v` *(calibration)* | — | 38.1% | 100% | 100% |
+handler, or a dangerous-protocol URL. The suite covers the major Node-compatible
+sanitizers, tag strippers, and HTML encoders with materially different APIs.
+
+| Library | Category | Security | Text kept | Markup kept | Ops/sec* |
+|---------|----------|----------|-----------|-------------|----------|
+| **Purifai** | strip-text | **100%** | **100%** | 0% *(by design)* | **341,705** |
+| striptags | strip-text | 100% | 100% | 0% | 674,214 |
+| DOMPurify | preserve-html | 100% | 100% | 100% | 1,809 |
+| sanitize-html | preserve-html | 100% | 100% | 100% | 85,340 |
+| xss | preserve-html | 100% | 100% | 100% | 240,911 |
+| rehype-sanitize | preserve-html | 100% | 100% | 100% | 23,738 |
+| escape-html | escape-html | 100% | 60% | 0% | 2,374,124 |
+| validator.escape | escape-html | 100% | 60% | 0% | 713,563 |
+| entities.escapeUTF8 | escape-html | 100% | 60% | 0% | 1,148,270 |
+| html-entities | escape-html | 100% | 60% | 0% | 890,538 |
+| he.escape | escape-html | 100% | 60% | 0% | 1,054,481 |
+| `() => ''` *(calibration)* | — | 100% | 0% | 0% | — |
+| `v => v` *(calibration)* | — | 38.1% | 100% | 100% | — |
 
 84 attack vectors (OWASP, PortSwigger, cure53 corpora) · 15 benign documents.
 
+\* Throughput is a single-process development snapshot captured on 2026-08-02
+with Node 26.3.0 on Apple Silicon. It varies by hardware and runtime and should
+only be compared within the same category. The command above is the source of
+truth. HTML encoders safely display the original markup as text; unlike Purifai
+and striptags, they do not turn markup-bearing input into clean reader text.
+
 > 📊 **Read this honestly.** On security there is no headroom left — every
 > maintained sanitizer above blocks everything thrown at it. The calibration rows
 > are the whole point: a function returning `''` also scores 100% security, which
@@ -348,7 +362,7 @@ const clean = sanitize(dirty);
 - **Multi-layer sanitization** with fallback mechanisms
 - **Context-aware parsing** to prevent bypass attempts
 - **Aggressive mode** for maximum security applications
-- **Zero false negatives** in comprehensive testing
+- **No executable output** across the current 84-vector benchmark corpus
 
 ### Encoded Attack Detection
 ```typescript
@@ -374,7 +388,7 @@ We welcome contributions! Please see our [Contributing Guide](CONTRIBUTING.md) f
 
 ### Development Setup
 ```bash
-git clone https://github.com/purifai/purifai.git
+git clone https://github.com/moji2002/purifai.git
 cd purifai
 pnpm install
 pnpm build
@@ -383,9 +397,14 @@ pnpm test
 
 ### Running Benchmarks
 ```bash
-pnpm benchmark  # Compare against other libraries
+pnpm benchmark
 ```
 
+This builds the published artifact, runs the two-axis competitor benchmark, and
+then measures Purifai's throughput, critical-attack checks, and bundle size. The
+competitor set and exact versions are pinned in `package.json` and
+`pnpm-lock.yaml` so results are reproducible.
+
 ## 📄 License
 
 MIT License - see [LICENSE](LICENSE) file for details.
@@ -404,10 +423,10 @@ MIT License - see [LICENSE](LICENSE) file for details.
 
 ---
 
-**⚡ Ready to secure your application? Install Purifai today and join the ranks of applications with bulletproof XSS protection.**
+**⚡ Need untrusted markup reduced to plain text? Install Purifai.**
 
 ```bash
 npm install purifai
 ```
 
-*Purifai - Because your users' security shouldn't be compromised.*
+*Purifai — strip untrusted markup, keep the text.*

package/dist/index.cjs

@@ -64,7 +64,7 @@ var DEFAULT_OPTIONS = {
   allowedProtocols: ["http", "https", "mailto"],
   aggressiveMode: true
 };
-var VERSION = "2.0.1";
+var VERSION = "2.0.2";
 var MAX_FILTER_PASSES = 5;
 function decodeEncodingBypasses(str) {
   let result = str;
@@ -401,6 +401,6 @@ var index_default = Purifai;
  * Advanced XSS protection with polyglot attack resistance.
  * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
  *
- * @version 2.0.1
+ * @version 2.0.2
  * @license MIT
  */

package/dist/index.d.cts

@@ -4,7 +4,7 @@
  * Advanced XSS protection with polyglot attack resistance.
  * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
  *
- * @version 2.0.1
+ * @version 2.0.2
  * @license MIT
  */
 /**

package/dist/index.d.ts

@@ -4,7 +4,7 @@
  * Advanced XSS protection with polyglot attack resistance.
  * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
  *
- * @version 2.0.1
+ * @version 2.0.2
  * @license MIT
  */
 /**

package/dist/index.js

@@ -32,7 +32,7 @@ var DEFAULT_OPTIONS = {
   allowedProtocols: ["http", "https", "mailto"],
   aggressiveMode: true
 };
-var VERSION = "2.0.1";
+var VERSION = "2.0.2";
 var MAX_FILTER_PASSES = 5;
 function decodeEncodingBypasses(str) {
   let result = str;
@@ -369,6 +369,6 @@ export {
  * Advanced XSS protection with polyglot attack resistance.
  * Blocks sophisticated obfuscation techniques that bypass other sanitizers.
  *
- * @version 2.0.1
+ * @version 2.0.2
  * @license MIT
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "purifai",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "Zero-dependency strip-to-text HTML sanitizer with contextual output encoding (HTML, attribute, URL). ~4.1KB gzipped, no DOM required - runs in Node, browsers and edge runtimes.",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -28,6 +28,7 @@
     "test:bench": "node test/comprehensive-test.js",
     "test:fair": "node test/fair-benchmark.js",
     "test:perf": "node test/verify-performance.js",
+    "benchmark": "pnpm run build && node test/fair-benchmark.js && node test/verify-performance.js",
     "prepublishOnly": "pnpm run test",
     "dev": "tsup index.ts --format cjs,esm --watch",
     "typecheck": "tsc --noEmit",
@@ -71,12 +72,20 @@
     "@types/node": "^26.0.0",
     "chalk": "^6.0.0",
     "cli-table3": "^0.6.5",
+    "entities": "^8.0.0",
+    "escape-html": "^1.0.3",
+    "he": "^1.2.0",
+    "html-entities": "^2.6.0",
     "isomorphic-dompurify": "^3.19.0",
     "jsdom": "^29.1.1",
     "playwright-core": "^1.62.0",
+    "rehype": "^13.0.2",
+    "rehype-sanitize": "^6.0.0",
     "sanitize-html": "^2.17.6",
+    "striptags": "^3.2.0",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",
+    "validator": "^13.15.35",
     "xss": "^1.0.15"
   }
 }