On GitHub, cure53/jPurify has picked up 65 stars, JavaScript. jPurify
Snapshot summary built from the project's own GitHub metadata — there's no written TopGit review yet. The page will update automatically when a full review is published.
WHY NO REVIEW YET
TopGit writes full reviews for the most-starred, most-requested repositories. This page is a snapshot until then — see the READ ME tab for the original README in full.
Warning: This tool is experimental and currently not maintained. Don't use it in production.
Please feel free to take it and feed it if you like it!
jPurify
jPurify is a plugin that automatically adds XSS-safety to jQuery. The reason why we do that is jQuery's lack of DOMXSS protection. We wanted to create a jQuery plugin, that adds super-easy-to-use and fully automatic HTML sanitation to the whole jQuery API. jPurify has been tested with jQuery 1.11.1 and 2.1.1. It's known to work well down until jQuery 1.5.2.
jPurify is maintained by the same people that look after DOMPurify. It works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else using Blink or WebKit). It doesn't break on IE6 or other legacy browsers. It simply does nothing there.
What does it do?
jPurify, once included, simply overwrites some security-critical jQuery methods and adds proper HTML sanitation. Let's have a look at an example to clarify (here's a small live-demo):
<html>
<head>
<script src="jquery.js"></script>
</head>
<body>
<div id="html"></div>
<script>
// location.hash could be <svg/onload=alert(domain)>
$('#html').html('<h1>'+location.hash+'</h1>');
</script>
</body>
</html>
This code shown above is vulnerable to XSS. An attacker can influence location.hash to contain evil HTML and then attack your website's users. Not nice. Now let's have a look at what jPurify accomplishes:
<html>
<head>
<script src="jquery.js"></script>
<!-- makes the code below be secure -->
<script src="purify.js"></script>
<script src="jpurify.js"></script>
</head>
<body>
<div id="html"></div>
<script>
// location.hash could be <svg/onload=alert(domain)>
$('#html').html('<h1>'+location.hash+'</h1>');
</script>
</body>
</html>
Now, the XSS attack is being blocked. jPurify inspects and sanitizes the arguments sent to the vulnerable methods. The bad stuff is being removed, the good stuff is left intact, happy times.
How do I use it?
It's easy. Just include DOMPurify and jPurify on your website. It will seamlessly plug into jQuery and sanitize any potentially dangerous DOM-transaction.
jQuery has crazy lots of XSS sinks and developers need to make sure that none is hit by user generated content. The more complex a website the harder that gets of course. That's where jPurify jumps in. We currently cover the following XSS sinks and sanitize them with DOMPurify:
No homepage URL was recorded for cure53/jPurify in TopGit's last sync. The README tab above frequently contains screenshots and demo links, or check the repository description on GitHub.
Does cure53/jPurify have any tags?
TopGit's last sync did not record any GitHub topics for cure53/jPurify. GitHub topics appear in the right sidebar of a repository page; that's the authoritative place to check.
How active is development on cure53/jPurify?
The most recent commit recorded on cure53/jPurify was 9.5 years ago, based on the GitHub push timestamp. The repository has 9 forks — one of the better signals of community interest.
Is cure53/jPurify open source?
Yes — cure53/jPurify ships under the MPL-2.0 license, which makes its source code freely readable (and, depending on license terms, forkable and reusable). Source: github.com/cure53/jPurify.
What license does cure53/jPurify use?
cure53/jPurify is released under the MPL-2.0 license. Always verify the LICENSE file directly on GitHub for the authoritative terms — license strings can be edited out of sync with a project's actual stance.
Where do I read more about cure53/jPurify?
This TopGit page is a snapshot — the READ ME tab shows the project's own README content (links stripped, images preserved). The GitHub repository at github.com/cure53/jPurify is the definitive source.
Read full README in the tab above.
Curious whether jPurify is right for you?
Let ChatGPT, Claude, or Perplexity look into it — click below and see what AI actually says about jPurify.