DOMPurify

The DOMParser.prototype.parseFromString function will return a Document:

const parser = new DOMParser();
const doc = parser.parseFromString('<img src=x onerror=alert(1)>', 'text/html');
console.log(doc.querySelectorAll("*")); // NodeList(4) [ html, head, body, img]

Assign .innerHTML (equal to <svg></p>whatever) with itself:

const el = document.createElement('div');
el.innerHTML = '<svg></p>whatever'; // "<svg></p>whatever"
el.innerHTML = el.innerHTML; // "<svg></svg><p></p>whatever"

Resources