This module strips scripting constructs out of HTML, leaving as much non- scripting markup in place as possible. This allows web applications to display HTML originating from an untrusted source without introducing XSS vulnerabilities.