One sanitizer pass is enough only if nothing touches the HTML afterward. Once your code, another library, or a different rendering context changes the markup, the earlier approval no longer describes what the browser will interpret. A second pass at the final boundary is a sensible guard when such changes can’t be removed. It is not a universal “always twice” rule, and neither OWASP nor the DOMPurify project says it is.
Why encoding isn’t an option for rich-text email
Rich-text editors produce paragraphs, links, lists and emphasis. Output-encoding that content shows the tags as literal text and destroys the formatting. When users are meant to author HTML, the OWASP Cross Site Scripting Prevention Cheat Sheet calls for an HTML sanitizer, and it specifically recommends DOMPurify. The OWASP Input Validation Cheat Sheet adds that validation and regular expressions don’t substitute for a maintained sanitization library. It also says normalization is not sanitization and does not replace output encoding.
As an Amazon Associate I earn from qualifying purchases.
Can HTML become unsafe after sanitization?
Yes. OWASP puts it bluntly: “If you sanitize content and then modify it afterwards, you can easily void your security efforts.” It warns specifically that mutation by another library can undo the protection.
The underlying problem is a trust-boundary mismatch. The sanitizer approves one representation of the markup. A later step then changes that representation, or the place where it is interpreted. Typical later steps include:
#1 Best Overall
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows, Mac OS, iOS, and Android. Organize and keep your digital life safe from hackers.
- ADVANCED THREAT DEFENSE: Your software is always up-to-date to defend against the latest attacks, and includes: complete real-time data protection, multi-layer malware, ransomware, cryptomining, phishing, fraud, and spam protection, and more.
- SUPERIOR PRIVACY PROTECTION: including a dedicated safe online banking browser, microphone monitor, webcam protection, anti-tracker, file shredder, parental controls, privacy firewall, anti-theft protection, social network protection, and more.
- TOP-TIER PERFORMANCE: Bitdefender technology provides near-zero impact on your computer’s hardware, including: Autopilot security advisor, auto-adaptive performance technology, game/movie/work modes, OneClick Optimizer, battery mode, and more
- rewriting links for click tracking;
- inlining styles or appending a footer by string manipulation;
- running the output through a templating, minifying or conversion library;
- moving the string from one HTML context into another.
I haven’t tested any of these steps against specific payloads or mail clients, and the guidance behind this article doesn’t audit Gmail, Outlook or Apple Mail. Treat the list as the kinds of steps to watch for, not as a catalogue of known bypasses.
Mutation XSS: why a clean-looking string isn’t permanently safe
The DOMPurify project’s Security Goals & Threat Model describes mutation XSS (mXSS) as parse asymmetry. Markup can look inert in the parsed tree the sanitizer inspects, then become active after it is serialized to a string and parsed again. The lesson is to tie sanitized output to the sink it was prepared for, not to treat the string as safe everywhere. The project’s own sentence: “Keep HTML going into an HTML sink, insert without post-processing, and don’t change the sink contract afterward.”
Rank #2
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows, Mac OS, iOS, and Android. Organize and keep your digital life safe from hackers.
- ADVANCED THREAT DEFENSE: Your software is always up-to-date to defend against the latest attacks, and includes: complete real-time data protection, multi-layer malware, ransomware, cryptomining, phishing, fraud, and spam protection, and more.
- SUPERIOR PRIVACY PROTECTION: including a dedicated safe online banking browser, microphone monitor, webcam protection, anti-tracker, file shredder, parental controls, privacy firewall, anti-theft protection, social network protection, and more.
- TOP-TIER PERFORMANCE: Bitdefender technology provides near-zero impact on your computer’s hardware, including: Autopilot security advisor, auto-adaptive performance technology, game/movie/work modes, OneClick Optimizer, battery mode, and more
Should you sanitize again after transforming it?
Use this decision order:
- Do trusted transformations first. Parse, rewrite links, add wrappers and so on before sanitizing, so the sanitizer sees the final content.
- Sanitize once, for the final context. Configure a maintained sanitizer for the rich-text profile you actually need.
- Insert without further mutation. No string concatenation, regex cleanup or library rewriting between the sanitizer and the sink.
- If a later transform can’t be eliminated, treat its output as untrusted again. Sanitize at the final boundary, immediately before insertion.
Step 4 is a practical inference from OWASP’s post-modification warning and DOMPurify’s sink guidance. Neither source claims two passes suffice for every pipeline. A second pass is defense in depth for an unavoidable late transform. It does not fix a design where unsafe content is later re-parsed in a different context.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Configuring for an HTML-only email preview
DOMPurify documents an HTML-only profile for cases like an email preview. It drops SVG and MathML, which removes that namespace surface. It also describes avoiding the serialize/reparse step by returning a fragment and appending it directly.
Rank #3
- ALL-IN-ONE SCAM DETECTION – Texts, emails, videos, and QR codes all get checked automatically. Sorting real from fake stops being your job.
- KEEP SCAMMERS OUT OF YOUR WALLET – Every click is no longer a gamble. Our scam detection spots suspicious texts, email scams, SMS phishing, and fake alerts before you click.
- QR CODE SCANNING – Point the app at any code and see where it actually leads before you scan it.
- DEEPFAKE DETECTION – When a video sounds like someone you know but isn't, you hear it from us first.
- ON-DEMAND CHECKS – Got a message you're unsure about? Run it through the app and know in seconds, wherever it came from.
const fragment = DOMPurify.sanitize(dirtyHtml, {
USE_PROFILES: { html: true },
RETURN_DOM_FRAGMENT: true
});
previewEl.replaceChildren(fragment);Here the sanitized DOM goes straight into the page with no intermediate string. If you must return a string, for example to store it, sanitize again where it is finally rendered rather than trusting the stored copy.
Comparing pipeline choices
| Axis | Safer choice | Riskier choice |
|---|---|---|
| Pipeline placement | Sanitize after all trusted transforms | Sanitize early, transform later |
| Context match | HTML-only profile when only HTML is needed | Allowing SVG/MathML without a need |
| Representation handoff | Direct DOM fragment insertion | Serialize to string, then reparse |
| Post-sanitization mutation | None | Application or library rewrites the output |
| Maintenance | Current, patched sanitizer | Stale dependency |
Keep the sanitizer current and test your own pipeline
OWASP says sanitizers should be regularly patched, because bypasses are discovered and browser behavior changes. The DOMPurify repository showed version 3.4.16 when checked on 2026-10-05. That is a volatile snapshot, not a recommendation to pin to it. Test with your real transformations and your real rendering sinks, since the risk comes from the combination, not from the sanitizer alone.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The Bottom Line
Don’t count passes; control the pipeline. Transform first, sanitize for the final context, insert without mutation, and sanitize again at the last boundary only when a late change can’t be avoided. Keep the sanitizer patched.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
Best Value
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows, Mac OS, iOS, and Android. Organize and keep your digital life safe from hackers.
- ADVANCED THREAT DEFENSE: Your software is always up-to-date to defend against the latest attacks, and includes: complete real-time data protection, multi-layer malware, ransomware, cryptomining, phishing, fraud, and spam protection, and more.
- SUPERIOR PRIVACY PROTECTION: including a dedicated safe online banking browser, microphone monitor, webcam protection, anti-tracker, file shredder, parental controls, privacy firewall, anti-theft protection, social network protection, and more.
- TOP-TIER PERFORMANCE: Bitdefender technology provides near-zero impact on your computer’s hardware, including: Autopilot security advisor, auto-adaptive performance technology, game/movie/work modes, OneClick Optimizer, battery mode, and more
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
