typo3/html-sanitizer
HTML sanitizer aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.
v2.3.2
11M downloads/mo
#1167 most downloaded on Packagist
TYPO3/html-sanitizer
What this package is like to depend on
Last release 2 months ago
08 Jun 2026
Release timing varies
gaps range from 3 weeks to 1.8 years
Some releases are documented
notes for 10 of 38 stable releases
Nothing withdrawn
no release was ever pulled
5 years old
38 releases · first in 2021
3 releases in the last 12 months
see the full history below
Release timeline
38 releases · Jul 2021 to Jun 2026Releases
latest 38-
v2.3.208 Jun 2026Release notes
Open source →What's Changed
- [SECURITY] Mitigate raw-text bypass with ALLOW_INSECURE_RAW_TEXT by @ohader in #128
- [SECURITY] Encode namespace attributes by @bnf in #129
Full Changelog: v2.3.1...v2.3.2
-
v2.3.130 Apr 2026 -
v2.3.030 Apr 2026Release notes
Open source →What's Changed
- [TASK] Add PHP 8.5 to CI matrix by @lolli42 in #120
- [!!!][TASK] Remove deprecated CommonBuilder->srcsetAttr by @lolli42 in #119
- [!!!][TASK] Require Behavior and Visitors in Sanitizer constructor by @ohader in #122
- [TASK] Clean up code in \TYPO3\HtmlSanitizer\Serializer\Rules by @ohader in #123
- [TASK] Clean up code in docs and test cases by @ohader in #124
Full Changelog: v2.2.0...v2.3.0
-
v2.2.012 Jul 2024Release notes
Open source → -
v2.1.414 Nov 2023Release notes
Open source →What's Changed
- [TASK] Disable test for unicode non breaking spaces substitution by @ohader in #112
- [TASK] Streamline logging by @ohader in #115
- [BUGFIX] Correctly import nodes with different owner document by @ohader in #114
- [SECURITY] Deny processing instructions in b8f9071
Full Changelog: v2.1.3...v2.1.4
-
v2.1.325 Jul 2023 -
v2.1.225 Jul 2023Release notes
Open source →What's Changed
- Sanitizer constructor documents array instead of spread by @dpi in #108
- [SECURITY] Properly encode noscript child nodes by @ohader & @bnf in e3026f5
Full Changelog: v2.1.1...v2.1.2
-
v2.1.113 Dec 2022Nothing published for this version
-
v2.1.005 Dec 2022Nothing published for this version
-
v2.0.1613 Sep 2022Nothing published for this version
-
v2.0.1527 Jul 2022Nothing published for this version
-
v2.0.1421 Feb 2022Nothing published for this version
-
v2.0.1312 Oct 2021Nothing published for this version
-
v2.0.1210 Oct 2021Nothing published for this version
-
v2.0.1121 Sep 2021Nothing published for this version
-
v2.0.1025 Aug 2021Nothing published for this version
-
v2.0.916 Aug 2021Nothing published for this version
-
v2.0.812 Aug 2021Nothing published for this version
-
v2.0.708 Aug 2021Nothing published for this version
-
v2.0.619 Jul 2021Nothing published for this version
-
v2.0.515 Jul 2021Nothing published for this version
-
v2.0.415 Jul 2021Nothing published for this version
-
v2.0.306 Jul 2021Nothing published for this version
-
v2.0.206 Jul 2021Nothing published for this version
-
v2.0.106 Jul 2021Nothing published for this version
-
v2.0.006 Jul 2021Nothing published for this version
-
v1.5.314 Nov 2023Release notes
Open source →What's Changed
- [TASK] Disable test for unicode non breaking spaces substitution by @ohader in #113
- [TASK] Adjust test case for PHP 7.0 by @ohader in #116
- [SECURITY] Deny processing instructions in cead6b6
Full Changelog: v1.5.2...v1.5.3
-
v1.5.225 Jul 2023 -
v1.5.125 Jul 2023 -
v1.5.013 Dec 2022Nothing published for this version
-
v1.0.713 Sep 2022Nothing published for this version
-
v1.0.625 Aug 2021Nothing published for this version
-
v1.0.516 Aug 2021Nothing published for this version
-
v1.0.412 Aug 2021Nothing published for this version
-
v1.0.312 Aug 2021Nothing published for this version
-
v1.0.208 Aug 2021Nothing published for this version
-
v1.0.119 Jul 2021Nothing published for this version
-
v1.0.015 Jul 2021Nothing published for this version