microcosm-cc/bluemonday
Bluemonday
bluemonday is a Go library for scrubbing user-generated HTML content to prevent cross-site scripting and other injection attacks. It functions as an HTML policy engine and sanitizer that removes dangerous scripts and malicious tags by applying configurable element and attribute allowlists.
The project distinguishes itself through a rule-based system that utilizes regular expressions and name-based lists to define permitted tags, attributes, and CSS styles. It includes a URL security validator that enforces safe protocols and automatically injects security attributes such as nofollow and noopener into outbound hyperlinks.
The library covers a broad range of sanitization capabilities, including inline CSS validation, data URI filtering for embedded images, and attribute value verification. It employs a streaming token-based parsing model to identify and scrub unsafe content without loading the entire document tree.
Features
- Cross-Site Scripting Prevention - Prevents cross-site scripting by cleaning user-submitted HTML content of malicious scripts.
- HTML Content Sanitization - Provides a comprehensive engine for scrubbing user-generated HTML content to prevent cross-site scripting and injection attacks.
- HTML Content Policies - Acts as a rule-based engine for defining permitted HTML tags, attributes, and CSS styles.
- CSS Sanitizers - Validates and cleans inline CSS style attributes to prevent malicious payloads from being injected via styles.
- Injection Prevention - Removes dangerous scripts and malicious tags from HTML documents to prevent injection attacks.
- Policy Configurations - Implements a flexible rule-based system using regular expressions and allowlists to define permitted HTML tags and attributes.
- Link Security Policies - Enforces security attributes and restricts permitted protocols for outbound hyperlinks.
- URL Protocol Sanitizers - Validates and transforms URL protocols to prevent javascript and data URI injection attacks.
- HTML Allowlists - Implements HTML allowlists to define permitted tags and attributes for secure rendering.
- Secure Renderers - Prepares raw HTML strings for safe browser display by stripping dangerous tags and enforcing link security.
- HTML Tokenization - Employs a streaming tokenization model to process HTML without loading the entire document tree into memory.
- URL and Data URI Filtering - Validates URLs and data URIs within HTML to restrict permitted protocols and ensure safe inline resources.
- Automatic Attribute Injection - Automatically injects security attributes such as nofollow and target blank into fully qualified outbound links.
- Resource URL Validations - Enforces safe URL protocols and manages security attributes for embedded resources and hyperlinks.
- Security Attribute Injection - Automatically appends security attributes like nofollow and noopener to outbound hyperlinks.
- Regular Expression Validations - Uses regular expression validations to identify and verify permitted element names and attribute values.
- Pattern-Based Value Validation - Verifies that attribute values match specific patterns, such as dates or alignment keywords, using regular expressions.
- CSS Security Validators - Provides specialized handlers to validate inline CSS style attributes against security patterns.
- Security Filtering - Verifies the mime-type and base64 encoding of data URIs to safely allow inline images.
- Security Validation - Ensures inline data URIs use safe image formats through MIME type and encoding verification.
- HTML Attribute Restrictions - Controls which attributes are permitted on specific HTML tags or groups of tags.
- Text Processing - HTML sanitizer for preventing XSS attacks.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
