Efficiently and securely remove <script> tags from source HTML

strip_tags.js

// This code would normally inject global variables and run an alert
// if injected in your document naively
const source = '<p>bla <script>window.SHIT=true</script></p><script>alert("SHIT")</script>'

// Crete a DocumentFragment from the source HTML
const frag = document.createRange().createContextualFragment(source)

// Remove all the <script> nodes
[...frag.querySelectorAll('script')].forEach((e)=> {
  e.parentNode.removeChild(e)
})

// Rebuils a clean source HTML
// We use reduce and concat here because there's no proper API to do this
const cleanHTML = [...frag.childNodes].reduce((m, e)=> {
  return m + (e.outerHTML || e.textContent)
}, '')