HTML Purifier
HTML Purifier is a library that cleans HTML content to remove malicious code like XSS and ensure it's standards-compliant. It can be configured to allow or restrict specific HTML elements and attributes, making it a more robust alternative to Drupal's built-in filtering.
HTML Purifier is a standards-compliant HTML filter library. HTML Purifier will not only remove all malicious code (better known as XSS) with a thoroughly audited, secure yet permissive whitelist, it will also make sure your documents are standards compliant, something only achievable with a comprehensive knowledge of W3C's specifications.
HTML Purifier is very tasty when combined with WYSIWYG editors and is more comprehensive, standards-compliant, permissive and extensive than Drupal's built-in filtered HTML option, which uses a derivative of kses. You can read more about it at this comparison page. Want custom fonts, tables, inline styling, images, and more? Want just a restricted tag set but bullet-proof standards-compliant output? HTML Purifier is for you!
The HTML Purifier module is licensed under GPL v2 or later, however, the HTML Purifier library itself is licensed under LGPL v2.1 or later.
Want to give it a test drive? Try it out on simplytest.me.
Install the module using composer:
composer require 'drupal/htmlpurifier:^1.0'
Enable it and configure the filter for each text format in Administration - Configuration - Text formats and editors (admin/config/content/formats).
You can use the HTML Purifier Configuration Documentation as reference to learn and edit the configuration settings available in YAML format within the filter settings form textarea.