Examples

Content security: try to break it

Most editor security demos show you a screenshot. This one runs the payloads. Edit the list below, add your own, and press the button — the page loads them into a real editor, takes whatever the editor saves, and renders that saved string the way your application would: inside a sandboxed frame where scripts are still allowed to run, so a regression would show up rather than be hidden by the harness.

That last step is the one that matters. An editor can strip every event handler and still store something that executes elsewhere. <iframe srcdoc>carries an entire document inside an attribute — no handler, no javascript: URL, nothing for a naive filter to notice. Testing inside the editor misses it entirely. The full account is in “Nothing executes in the editor” is the wrong bar.

Configuration

// The sanitizer is on by default. It filters on the way in
// (set / paste / drop) AND on the way out.
var editor = new RichTextEditor("#editor", {
    contentSanitizer: true,                        // default

    // Optional: restrict which hosts may be framed. Without this,
    // https frames are kept but forced into a restrictive sandbox.
    sanitizerAllowedIframeHosts: ["www.youtube.com"],

    sanitizerAllowStyleTags: false,                // default
    sanitizerAllowTags: [],                        // extend the allowlist
    sanitizerAllowAttributes: []
});

// Clean a string yourself:
var clean = editor.sanitizeHtml(untrustedHtml);

// Inspect what has been stripped so far:
console.log(editor.getSanitizerReport());
// { removedTags: ["script","iframe","object","style","base"],
//   removedAttributes: ["onerror","srcdoc","a[href]"], calls: 3 }

This is defence in depth, not a substitute for server-side validation.It runs in the browser, and anything that runs in the browser can be skipped by a client that simply does not run it — an attacker can POST to your API directly and never load this JavaScript at all. Sanitize on the server before you store, and escape on output. This layer protects the honest path and cleans content on its next save; it does not make untrusted HTML safe to render unconditionally.