Question about sanitizing HTML content with WHOLE_DOCUMENT option about dompurify

[cure53]

would like to know if there is any way to maintain the same/invalid HTML as it is and sanitize only for cross-site scripting?

I think you can do this by pretending it's XML or HTML, then the browser is more tolerant. You can use the config options to do that, i.e. by defining a different NAMESPACE or PARSER_MEDIA_TYPE.

See here: https://github.com/cure53/DOMPurify#control-our-allow-lists-and-block-lists

Additionally, is there any way to keep the comments section as it is, at least?

Yup, you can allow the #comment element using the ADD_TAGS config.

[cure53]

Hey there 🙂 The HTML you are submitting for sanitization is invalid and DOMPurify turns it into valid HTML as it uses the browser's DOM internally.

A <table> cannot legally contain a <b> element.

So, technically, it's the browser (or server-side DOM) that transforms the HTML into no longer being invalid.

[agnijalam]

@cure53 Thank you so much for the quick response.
I completely agree with you. I have a few queries.
I would like to know if there is any way to maintain the same/invalid HTML as it is and sanitize only for cross-site scripting?.
Additionally, is there any way to keep the comments section as it is, at least?