{"action":"created","issue":{"url":"https://api.github.com/repos/cristo-rabani/meteor-universe-html-purifier/issues/7","labels_url":"https://api.github.com/repos/cristo-rabani/meteor-universe-html-purifier/issues/7/labels{/name}","comments_url":"https://api.github.com/repos/cristo-rabani/meteor-universe-html-purifier/issues/7/comments","events_url":"https://api.github.com/repos/cristo-rabani/meteor-universe-html-purifier/issues/7/events","html_url":"https://github.com/cristo-rabani/meteor-universe-html-purifier/issues/7","id":82421411,"number":7,"title":"Comparison with sanitize-html","user":{"login":"dandv","id":33569,"avatar_url":"https://avatars.githubusercontent.com/u/33569?v=3","gravatar_id":"","url":"https://api.github.com/users/dandv","html_url":"https://github.com/dandv","followers_url":"https://api.github.com/users/dandv/followers","following_url":"https://api.github.com/users/dandv/following{/other_user}","gists_url":"https://api.github.com/users/dandv/gists{/gist_id}","starred_url":"https://api.github.com/users/dandv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dandv/subscriptions","organizations_url":"https://api.github.com/users/dandv/orgs","repos_url":"https://api.github.com/users/dandv/repos","events_url":"https://api.github.com/users/dandv/events{/privacy}","received_events_url":"https://api.github.com/users/dandv/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-05-29T13:10:26Z","updated_at":"2015-05-30T11:22:50Z","closed_at":null,"body":"While searching for [HTML sanitization packages on Atmosphere](https://atmospherejs.com/?q=sanitize), I found [this package](https://atmospherejs.com/vazco/universe-html-purifier) and a wrapper package around @punkave's very popular [sanitize-html](https://www.npmjs.com/package/sanitize-html).\r\n\r\nSince sanitization is tricky and the risks are important, I was wondering how this package compares to prior art, and what the rationale was when creating it."},"comment":{"url":"https://api.github.com/repos/cristo-rabani/meteor-universe-html-purifier/issues/comments/107025158","html_url":"https://github.com/cristo-rabani/meteor-universe-html-purifier/issues/7#issuecomment-107025158","issue_url":"https://api.github.com/repos/cristo-rabani/meteor-universe-html-purifier/issues/7","id":107025158,"user":{"login":"cristo-rabani","id":2906283,"avatar_url":"https://avatars.githubusercontent.com/u/2906283?v=3","gravatar_id":"","url":"https://api.github.com/users/cristo-rabani","html_url":"https://github.com/cristo-rabani","followers_url":"https://api.github.com/users/cristo-rabani/followers","following_url":"https://api.github.com/users/cristo-rabani/following{/other_user}","gists_url":"https://api.github.com/users/cristo-rabani/gists{/gist_id}","starred_url":"https://api.github.com/users/cristo-rabani/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cristo-rabani/subscriptions","organizations_url":"https://api.github.com/users/cristo-rabani/orgs","repos_url":"https://api.github.com/users/cristo-rabani/repos","events_url":"https://api.github.com/users/cristo-rabani/events{/privacy}","received_events_url":"https://api.github.com/users/cristo-rabani/received_events","type":"User","site_admin":false},"created_at":"2015-05-30T11:22:50Z","updated_at":"2015-05-30T11:22:50Z","body":"Hello,\r\n\r\nIf keeping in db original source of content (potentially with js) is acceptable for you\r\nYou can purifying such data just before adding to the dom. For example it can be helper in template \r\n```\r\n{{{purify untrustHtml}}}\r\n```\r\nEven if someone inject somehow script to the value\r\nDisplaying of this content will be safely for other users.\r\n\r\n- **the advantage** of this solution:\r\n -  Saving server resources\r\n -  We have originally data source\r\n- **the disadvantage**\r\n - We must purify always before such content will be loaded. \r\n - We cannot forget about this operation in other places.\r\n\r\n\r\nBut if you want have safely of html content in database you should purifying data on server side or both sides. ( I seen that some developers make the purifying in autovalue method in SimpleSchema, or even as a validator )"}}