gbirke
Sanitize isn't doing anything?
It does work it just returns a document fragment instead of 'foo' like as expected in the docs. Perhaps you want to replace the element with the filtered element like this. http://jsfiddle.net/fe9pd8uy/3/
Shouldn't the default code strip all tags and just leave 'foo'? Why is the img tag still there?
What it does when you call sanitize is return a sanitized node. It does not modify the node directly that you select. You need to replace the un-sanitized node with the sanitized one. I tried to explain it a little more in this fiddle what I did in my last fiddle. http://jsfiddle.net/fe9pd8uy/5/
I get the feeling that if you're trying to prevent XSS you probably should never have unsafe dom elements on your page so you would do it more like this. This might be a general use case if that's your case. http://jsfiddle.net/fe9pd8uy/6/.
Sorry for the late reply.