Markdown Sanitizers
https://github.com/vercel-labs/markdown-sanitizers- Category
- Cybersecurity
- Rank
- No. 1478Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- vercel-labs
- GitHub
- 131 stars
- Latest release
- rehype-harden@1.1.8
- Date
About
TypeScript markdown sanitizers for safer AI-agent output — defend against prompt injection in rendered responses.
What it does
A small npm monorepo with separate defenses for two publishing paths. One package wraps React markdown rendering and filters link and image destinations against explicit prefix lists. Another parses markdown into HTML, sanitizes tags, attributes, and URLs, then converts the result back to markdown for third-party renderers.
Why it's ranked here
The design addresses output security at the point where dangerous destinations become actionable. It normalizes URLs, checks origins and prefixes, blocks known dangerous protocols, and tests malformed inputs and bypass attempts. The repository also states the boundary clearly: these controls have subtle security properties and still require application-specific testing.
What's good
Defaults are restrictive: links and images are blocked when no prefixes are allowed. Blocked content can become an indicator, plain text, or nothing. Relative URLs are resolved before validation, allowed links gain safer new-window attributes, malformed tree children are removed before traversal, and the markdown converter limits input and URL lengths.
Tradeoffs
The React layer only hardens URLs inside markdown nodes. Embedded raw HTML bypasses it unless a separate HTML sanitizer runs afterward. Sanitizing markdown before another service renders it is explicitly described as less secure than controlling final HTML. The conversion package can also change formatting, blank attribute text, truncate long input, or return empty output after processing failure.
How to use it well
Use it for React applications rendering untrusted markdown, or pipelines sending generated markdown to GitHub or GitLab. Define narrow link and image prefixes, choose an origin for relative URLs, and test hostile samples from your own application. Add HTML sanitization whenever raw HTML parsing is enabled. It does not replace broader security testing or guarantee third-party rendering safety.
Technical notes+
The root package.json defines a private pnpm workspace surface with recursive check, test, build, and release scripts. rehype-harden/src/index.ts exports harden and BlockPolicy, traverses HAST nodes, normalizes URLs, applies origin-aware prefix checks, rejects javascript:, data:, file:, and vbscript:, and rewrites blocked links or images. harden-react-markdown/src/index.tsx appends that rehype plugin to a supplied react-markdown component. markdown-to-markdown-sanitizer/src/index.ts runs remark parsing, raw HTML processing, DOM sanitization, and Turndown conversion; markdown-to-markdown-sanitizer/src/html-sanitizer.ts uses DOMPurify with JSDOM and explicit tag and attribute allow-lists; markdown-to-markdown-sanitizer/src/url-normalizer.ts enforces prefix and length rules. Vitest configurations cover Node and jsdom environments, while harden-react-markdown/src/bypass-attempts.test.tsx and markdown-to-markdown-sanitizer/tests/code-blocks.test.ts exercise bypass files and code preservation.
Observed
- License
- MIT
- Primary language
- TypeScript, including TSX for the React package
- Packaging
- Private pnpm monorepo containing related npm packages
- Interfaces
- Library interfaces for React rendering, HAST processing, and markdown-to-markdown sanitization
- Rendering environments
- Supports controlled React rendering and markdown destined for third parties such as GitHub or GitLab
- Test structure
- Vitest configurations cover Node and jsdom, with source tests and a dedicated tests directory
Read from README.md, package.json, rehype-harden/vitest.config.ts, harden-react-markdown/vitest.config.mjs, markdown-to-markdown-sanitizer/vitest.config.ts, rehype-harden/src/index.ts, harden-react-markdown/src/index.tsx, harden-react-markdown/src/index.test.tsx, markdown-to-markdown-sanitizer/src/index.ts, markdown-to-markdown-sanitizer/src/types.ts, harden-react-markdown/src/bypass-attempts.test.tsx, markdown-to-markdown-sanitizer/src/html-sanitizer.ts, markdown-to-markdown-sanitizer/src/url-normalizer.ts, harden-react-markdown/test/setup.ts, markdown-to-markdown-sanitizer/tests/code-blocks.test.ts.
What it can do
Sanitize markdown content for AI-generated output
Markdown text from AI agents → Sanitized markdown text
Remove malicious prompt injection attempts from markdown
Potentially compromised markdown content → Clean markdown without injection attempts
Filter dangerous HTML elements from markdown
Markdown with embedded HTML → Safe markdown with harmful HTML removed
Validate markdown content before rendering
Raw markdown from untrusted sources → Validation results and safe content
Strip executable content from markdown responses
Markdown containing scripts or dangerous elements → Sanitized markdown without executable content
Tags
Tech Stack
Media
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.