I disagree, dompurify takes a blacklist approach of trying to remove evil instead of only allowing through application-specific sane things (that it uses whitelists is a separate thing)
The fact that their list is not namespace-specific is a bigger issue imo.