{"repo":"microcosm-cc/bluemonday","free":true,"listed":false,"github":"https://github.com/microcosm-cc/bluemonday","clone":"git clone https://github.com/microcosm-cc/bluemonday.git","description":"bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS","language":"Go","stars":3709,"topics":["sanitization","html","security","xss","go","owasp","allowlist","golang"],"license":"BSD-3-Clause","category":"security-tools","readme_excerpt":"bluemonday bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable. bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against an allowlist of approved HTML elements and attributes so that you can safely include the content in your web page. If you accept user generated content, and your server uses Go, you need bluemonday. The default policy for user generated content ( bluemonday.UGCPolicy().Sanitize() ) turns this: Into a harmless: And it turns this: Into this: Whilst still allowing this: To pass through mostly unaltered (it gained a rel=\"nofollow\" which is a good thing for user generated content): It protects sites from XSS attacks. There are many vectors for an XSS attack and the best way to mitigate the risk is to sanitize user input against a known safe list of HTML elements and attributes. You should always run bluemonday after any other processing. If you use blackfriday or Pandoc then bluemonday should be run after these steps. This ensures that no insecure HTML is introduced later in your process. bluemonday is heavily inspired by both the OWASP Java HTML Sanitizer and the HTML Purifier. Technical Summary Allowlist based, you need to either build a policy describing the HTML elements and attributes to permit (and the regexp patterns of attributes), or use one of the supplied policies representing good defaults. The policy containing the allowlist is applied using a fast non-valida","default_branch":null,"files":null,"tree":[],"storefront":"/r/microcosm-cc","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/microcosm-cc/bluemonday/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}