Element: setHTML()

setHTML(input)
setHTML(input, options)

// HTML 
const unsanitizedString = "abc <script>alert(1)<" + "/script> def";
// ID  "target" 
const target = document.getElementById("target");

// setHTML() 
target.setHTML(unsanitizedString);

//  setHTML() 
//  div, p, button script 
const sanitizer1 = new Sanitizer({
  elements: ["div", "p", "button", "script"],
});
target.setHTML(unsanitizedString, { sanitizer: sanitizer1 });

//  SanitizerConfig  setHTML() 
// divpbuttonscript/
target.setHTML(unsanitizedString, {
  sanitizer: { removeElements: ["div", "p", "button", "script"] },
});

<button id="buttonDefault" type="button"></button>
<button id="buttonAllowScript" type="button">allowScript</button>

<button id="reload" type="button"></button>
<div id="target"></div>

<pre id="log"></pre>

#log {
  height: 220px;
  overflow: scroll;
  padding: 0.5rem;
  border: 1px solid black;
  margin: 5px;
}

const logElement = document.querySelector("#log");
function log(text) {
  logElement.textContent += text;
}

if ("Sanitizer" in window) {

// HTML 
const unsanitizedString = `
  <div>
    <p>This is a paragraph. <button >Click me</button></p>
    <script src="path/to/a/module.js" type="module"><script>
  </div>
`;

const reload = document.querySelector("#reload");
reload.addEventListener("click", () => document.location.reload());

const defaultSanitizerButton = document.querySelector("#buttonDefault");
defaultSanitizerButton.addEventListener("click", () => {
  // 
  target.setHTML(unsanitizedString);

  //  HTML 
  logElement.textContent =
    "Default sanitizer: remove script element and onclick attribute\n\n";
  log(`\nunsanitized: ${unsanitizedString}`);
  log(`\nsanitized: ${target.innerHTML}`);
});

const allowScriptButton = document.querySelector("#buttonAllowScript");
allowScriptButton.addEventListener("click", () => {
  // 
  const sanitizer1 = new Sanitizer({
    elements: ["div", "p", "script"],
  });
  target.setHTML(unsanitizedString, { sanitizer: sanitizer1 });

  //  HTML 
  logElement.textContent =
    "Sanitizer: {elements: ['div', 'p', 'script']}\n Script removed even though allowed\n";
  log(`\nunsanitized: ${unsanitizedString}`);
  log(`\nsanitized: ${target.innerHTML}`);
});

} else {
  log("HTML  API ");
  // 
}