Skip to content
FrameworkJavaScript

Sanitizer API: how content is cleaned

Clean and sanitize HTML content to prevent XSS attacks.

Edit this page on GitHub

Reaching the editor instance

The methods below run on the editor you created with new Blok(). They are available once editor.isReady resolves.

TypeScript
// You already hold the instance returned by the constructor.
const editor = new Blok({ holder: 'editor' });
await editor.isReady;

// Call any API method on it.
editor.caret.setToLastBlock('end');

Methods

sanitizer.clean(taintString, config)

string

Clean HTML string using the provided sanitizer configuration.

When to use

Strip unwanted HTML against a rule set before inserting external content — your defence for paste and imported strings.

TypeScript
const dirtyHtml = '<script>alert("xss")</script><p>Hello</p>';
const clean = editor.sanitizer.clean(dirtyHtml, {
  p: true,  // Allow <p> tags
  b: true   // Allow <b> tags
});
// Returns: '<p>Hello</p>' (script tag removed)