A fast, configurable HTML sanitizer for Go that scrubs user-generated content of XSS attacks using an allowlist policy.
bluemonday is a Go library designed to sanitize HTML by removing potentially dangerous elements and attributes that could lead to cross-site scripting (XSS) attacks. It processes untrusted user-generated content against a configurable allowlist policy, ensuring only safe HTML is output. The library is optimized for speed and is production-ready, having been migrated from the OWASP Java HTML Sanitizer.
Go developers building web applications that accept user-generated HTML content, such as comment systems, forums, or rich-text editors, where preventing XSS is critical.
Developers choose bluemonday for its robust security model, high performance, and ease of integration. It offers predefined policies for common use cases, extensive customization for complex requirements, and is battle-tested in production environments.
bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses Go's net/html parser for fast token-based sanitization, minimizing latency in web applications as highlighted in the README's technical summary.
Employs an allowlist approach to eliminate XSS vectors, with examples showing effective removal of malicious scripts like onmouseover and javascript: URLs.
Offers a fluent API for custom allowlists, plus predefined policies like UGCPolicy for user-generated content, allowing granular control over elements and attributes.
Includes options for URL validation, rel='nofollow', and automatic noopener addition to prevent tabnabbing, as detailed in the links section.
Follows GIGO (garbage in, garbage out) and does not fix badly nested or incomplete HTML, which can lead to broken output if user content is malformed.
Sanitizing inline CSS requires custom regex matching or handlers, making it error-prone and difficult to secure without deep expertise, as warned in the limitations.
Lacks blacklisting capabilities, so policies must be explicitly defined from scratch, which can be cumbersome for teams wanting to remove specific elements from a broader set.