bluemonday HTML Sanitizer

Install the bluemonday HTML sanitizer using go get:

go get github.com/microcosm-cc/bluemonday

bluemonday provides pre-configured policies for common use cases. You can use bluemonday.UGCPolicy() for user-generated content (allowing safe formatting like links and images) or bluemonday.StrictPolicy() to strip all HTML elements and attributes entirely.

Important: Policy creation/editing is not thread-safe. Create your policy once and reuse it. However, once created, the policy instance is safe to use for sanitization across multiple goroutines.

package main

import (
	"fmt"

	"github.com/microcosm-cc/bluemonday"
)

func main() {
	// Create the policy once
	p := bluemonday.UGCPolicy()

	// Use the policy to sanitize input (safe for multiple goroutines)
	html := p.Sanitize(
		`<a onblur="alert(secret)" href="http://www.google.com">Google</a>`,
	)

	// Output: <a href="http://www.google.com" rel="nofollow">Google</a>
	fmt.Println(html)
}

Instead of using a single complex regex for the style attribute, use bluemonday's specialized style policy methods. First, allow the style attribute on specific elements, then use AllowStyles to define permitted properties and their allowed values.

Available methods for style validation:

• .Matching(regex): Validates the property value against a regular expression.
• .MatchingEnum(values...): Restricts the property to a specific set of allowed values.
• .MatchingHandler(func(string) bool): Uses a custom function to validate the property value (the input string is lowercased and unicode-normalized).

Use these convenience methods to quickly permit common HTML structures:

• AllowStandardAttributes(): Permits dir, id, lang, and title globally.
• AllowImages(): Permits the img element and its standard attributes.
• AllowLists(): Permits ordered, unordered, and definition lists.
• AllowTables(): Permits HTML tables and all applicable elements/non-styling attributes.

p.AllowStandardAttributes()
p.AllowImages()
p.AllowLists()
p.AllowTables()

To create a new policy, use bluemonday.NewPolicy(). You can build a policy by specifying allowed elements and attributes. It is highly recommended to use regular expressions with .Matching() for attributes to prevent XSS. You can also extend existing policies like bluemonday.UGCPolicy().

To sanitize HTML, call .Sanitize(htmlIn) on your policy instance.

p := bluemonday.NewPolicy()
p.AllowElements("b", "strong")
p.AllowAttrs("title").Matching(regexp.MustCompile(`[\p{L}\p{N}\s\-_',:\[\]!\./\\\(\)&]*`)).Globally()

htmlOut := p.Sanitize(htmlIn)

You can define a custom allowlist of elements and attributes using bluemonday.NewPolicy(). This allows you to control exactly which tags and attributes are permitted and even enforce URL schemes.

package main

import (
	"fmt"

	"github.com/microcosm-cc/bluemonday"
)

func main() {
	p := bluemonday.NewPolicy()

	// Require URLs to be parseable by net/url.Parse and either: mailto:, http:// or https://
	p.AllowStandardURLs()

	// Only allow <p> and <a href=""> tags
	p.AllowAttrs("href").OnElements("a")
	p.AllowElements("p")

	html := p.Sanitize(
		`<a onblur="alert(secret)" href="http://www.google.com">Google</a>`,
	)

	// Output: <a href="http://www.google.com">Google</a>
	fmt.Println(html)
}

The policy object provides three methods for sanitization depending on your input type:

• p.Sanitize(string) string: For standard string inputs.
• p.SanitizeBytes([]byte) []byte: For byte slice inputs.
• p.SanitizeReader(io.Reader) bytes.Buffer: For streaming inputs via an io.Reader. This is the most performant option for large inputs as it avoids unnecessary casting.

bluemonday ships with two primary default policies:

1. bluemonday.StrictPolicy(): Strips all HTML elements and attributes. Use this when no HTML is expected (e.g., blog post titles).
2. bluemonday.UGCPolicy(): Allows a broad selection of safe HTML elements and attributes for user-generated content (e.g., blog post bodies). It does not allow iframes, object, embed, styles, or script tags.