bluemonday
A fast, configurable HTML sanitizer for Go that scrubs user-generated content of XSS attacks using an allowlist policy.
What is bluemonday?
bluemonday is a Go library designed to sanitize HTML by removing potentially dangerous elements and attributes that could lead to cross-site scripting (XSS) attacks. It processes untrusted user-generated content against a configurable allowlist policy, ensuring only safe HTML is output. The library is optimized for speed and is production-ready, having been migrated from the OWASP Java HTML Sanitizer.
Go developers building web applications that accept user-generated HTML content, such as comment systems, forums, or rich-text editors, where preventing XSS is critical.
Developers choose bluemonday for its robust security model, high performance, and ease of integration. It offers predefined policies for common use cases, extensive customization for complex requirements, and is battle-tested in production environments.
Overview
bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
Use Cases
Best For
- Sanitizing HTML in Go web applications before rendering user-generated content
- Preventing XSS attacks in comment sections, forums, or blog platforms
- Securing rich-text editor output in admin panels or CMS interfaces
- Filtering HTML emails or notifications to remove malicious scripts
- Enforcing strict HTML policies in multi-tenant SaaS applications
- Replacing or complementing other sanitizers like OWASP Java HTML Sanitizer in Go projects
Not Ideal For
- Projects that need to repair or validate HTML structure, as bluemonday assumes well-formed input and does not fix nesting or missing tags
- Applications requiring inline JavaScript or complex CSS by default, since these are stripped and safe configuration requires non-trivial regex or handler setup
- Teams seeking a zero-configuration sanitizer, because custom policies demand careful allowlist definition to avoid security gaps
- Non-Go environments, as bluemonday is implemented solely in Go and cannot be used directly in other programming languages
Pros & Cons
Pros
Uses Go's net/html parser for fast token-based sanitization, minimizing latency in web applications as highlighted in the README's technical summary.
Employs an allowlist approach to eliminate XSS vectors, with examples showing effective removal of malicious scripts like onmouseover and javascript: URLs.
Offers a fluent API for custom allowlists, plus predefined policies like UGCPolicy for user-generated content, allowing granular control over elements and attributes.
Includes options for URL validation, rel='nofollow', and automatic noopener addition to prevent tabnabbing, as detailed in the links section.
Cons
Follows GIGO (garbage in, garbage out) and does not fix badly nested or incomplete HTML, which can lead to broken output if user content is malformed.
Sanitizing inline CSS requires custom regex matching or handlers, making it error-prone and difficult to secure without deep expertise, as warned in the limitations.
Lacks blacklisting capabilities, so policies must be explicitly defined from scratch, which can be cumbersome for teams wanting to remove specific elements from a broader set.
Frequently Asked Questions
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.