sanitization
Safeguard articles tagged "sanitization" — guides, analysis, and best practices for software supply chain and application security.
8 articles
react-quill and Quill: XSS History and Safe Rich-Text Editing
Using Quill in React means understanding CVE-2021-3163, the react-quill maintenance gap, and why editor output must always be sanitized server-side before display.
tinymce-angular Security: What to Know Before You Ship
The tinymce-angular wrapper is thin, but it ships a full rich-text editor whose sanitization gaps have produced real XSS CVEs. Here is how to use it safely.
Is html-react-parser Safe? Rendering HTML in React Without an XSS Hole
html-react-parser converts an HTML string into React elements, but it is not a sanitizer. Here is how to use it and where the XSS risk really sits.
Showdown Markdown Converter: XSS Risks and Safe Configuration
The npm showdown library converts Markdown to HTML without sanitizing it — by design. Here is where the XSS risk actually lives and how to render untrusted Markdown safely.
TinyMCE npm Security: XSS History and Safe Configuration
The tinymce npm package is a capable rich-text editor with a long history of XSS advisories. Keeping it current and configuring it defensively is what keeps it safe.
Is turndown on npm Safe? A Security Review
turndown converts HTML to Markdown with no known CVEs, but the real risk is what you do with its input and output. Here is how to use it safely.
marked on npm: Security Review and Safe Usage
marked is a fast Markdown parser, but it does not sanitize output and older versions carried a ReDoS bug. Here is how to use marked npm without opening an XSS hole.
The xss npm Package: Sanitizing HTML Input Correctly
The xss npm package is a whitelist-based HTML sanitizer for Node and the browser. It works well — when you sanitize in the right place, with the right whitelist, for the right output context.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.