DOMPurify: Client-Side Protection Against XSS and Markup Injection
Scriptless attacks: stealing the pie without touching the sill