# microcosm-cc/bluemonday **Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/microcosm-cc-bluemonday).** _How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._ 3,688 stars · 193 forks · Go · BSD-3-Clause ## Links - GitHub: https://github.com/microcosm-cc/bluemonday - Homepage: https://github.com/microcosm-cc/bluemonday - awesome-repositories: https://awesome-repositories.com/repository/microcosm-cc-bluemonday.md ## Topics `allowlist` `go` `golang` `html` `owasp` `sanitization` `security` `xss` ## Description bluemonday is a Go library for scrubbing user-generated HTML content to prevent cross-site scripting and other injection attacks. It functions as an HTML policy engine and sanitizer that removes dangerous scripts and malicious tags by applying configurable element and attribute allowlists. The project distinguishes itself through a rule-based system that utilizes regular expressions and name-based lists to define permitted tags, attributes, and CSS styles. It includes a URL security validator that enforces safe protocols and automatically injects security attributes such as nofollow and noopener into outbound hyperlinks. The library covers a broad range of sanitization capabilities, including inline CSS validation, data URI filtering for embedded images, and attribute value verification. It employs a streaming token-based parsing model to identify and scrub unsafe content without loading the entire document tree. ## Tags ### Security & Cryptography - [Cross-Site Scripting Prevention](https://awesome-repositories.com/f/security-cryptography/cross-site-scripting-prevention.md) — Prevents cross-site scripting by cleaning user-submitted HTML content of malicious scripts. - [HTML Content Sanitization](https://awesome-repositories.com/f/security-cryptography/html-content-sanitization.md) — Provides a comprehensive engine for scrubbing user-generated HTML content to prevent cross-site scripting and injection attacks. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/README.md)) - [CSS Sanitizers](https://awesome-repositories.com/f/security-cryptography/css-sanitizers.md) — Validates and cleans inline CSS style attributes to prevent malicious payloads from being injected via styles. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/README.md)) - [Injection Prevention](https://awesome-repositories.com/f/security-cryptography/injection-prevention.md) — Removes dangerous scripts and malicious tags from HTML documents to prevent injection attacks. - [Policy Configurations](https://awesome-repositories.com/f/security-cryptography/injection-prevention/html-sanitization/policy-configurations.md) — Implements a flexible rule-based system using regular expressions and allowlists to define permitted HTML tags and attributes. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/policies.go)) - [Link Security Policies](https://awesome-repositories.com/f/security-cryptography/link-security-policies.md) — Enforces security attributes and restricts permitted protocols for outbound hyperlinks. ([source](https://github.com/microcosm-cc/bluemonday)) - [URL Protocol Sanitizers](https://awesome-repositories.com/f/security-cryptography/security/application-and-web/web-application/security-sanitization/url-protocol-sanitizers.md) — Validates and transforms URL protocols to prevent javascript and data URI injection attacks. - [HTML Allowlists](https://awesome-repositories.com/f/security-cryptography/security/utilities/allowlist-management/html-allowlists.md) — Implements HTML allowlists to define permitted tags and attributes for secure rendering. - [URL and Data URI Filtering](https://awesome-repositories.com/f/security-cryptography/application-and-system-security/browser-security/content-filtering-blocking/content-filtering/html-content-filters/url-and-data-uri-filtering.md) — Validates URLs and data URIs within HTML to restrict permitted protocols and ensure safe inline resources. - [Automatic Attribute Injection](https://awesome-repositories.com/f/security-cryptography/link-security-policies/automatic-attribute-injection.md) — Automatically injects security attributes such as nofollow and target blank into fully qualified outbound links. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/policy.go)) - [Resource URL Validations](https://awesome-repositories.com/f/security-cryptography/security/policies/host-resource-access/file-system-access-controls/path-access-restrictions/path-access-restrictions/url-path-restrictions/url-security-policy-enforcement/resource-url-validations.md) — Enforces safe URL protocols and manages security attributes for embedded resources and hyperlinks. ### DevOps & Infrastructure - [HTML Content Policies](https://awesome-repositories.com/f/devops-infrastructure/infrastructure/configuration-policy-enforcement/html-content-policies.md) — Acts as a rule-based engine for defining permitted HTML tags, attributes, and CSS styles. ### Web Development - [Secure Renderers](https://awesome-repositories.com/f/web-development/html-content-renderers/secure-renderers.md) — Prepares raw HTML strings for safe browser display by stripping dangerous tags and enforcing link security. - [HTML Attribute Restrictions](https://awesome-repositories.com/f/web-development/html-attribute-restrictions.md) — Controls which attributes are permitted on specific HTML tags or groups of tags. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/policy_test.go)) ### Data & Databases - [HTML Tokenization](https://awesome-repositories.com/f/data-databases/token-based-streaming-parsers/html-tokenization.md) — Employs a streaming tokenization model to process HTML without loading the entire document tree into memory. ### Software Engineering & Architecture - [Security Attribute Injection](https://awesome-repositories.com/f/software-engineering-architecture/regex-pattern-validators/attribute-injection-validators/security-attribute-injection.md) — Automatically appends security attributes like nofollow and noopener to outbound hyperlinks. - [Regular Expression Validations](https://awesome-repositories.com/f/software-engineering-architecture/regular-expression-validations.md) — Uses regular expression validations to identify and verify permitted element names and attribute values. ### Testing & Quality Assurance - [Pattern-Based Value Validation](https://awesome-repositories.com/f/testing-quality-assurance/html-attribute-validation/pattern-based-value-validation.md) — Verifies that attribute values match specific patterns, such as dates or alignment keywords, using regular expressions. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/helpers.go)) ### User Interface & Experience - [CSS Security Validators](https://awesome-repositories.com/f/user-interface-experience/css-property-validations/css-security-validators.md) — Provides specialized handlers to validate inline CSS style attributes against security patterns. - [Security Filtering](https://awesome-repositories.com/f/user-interface-experience/image-embeddings/data-uri-embeddings/security-filtering.md) — Verifies the mime-type and base64 encoding of data URIs to safely allow inline images. ([source](https://github.com/microcosm-cc/bluemonday/blob/main/README.md)) - [Security Validation](https://awesome-repositories.com/f/user-interface-experience/image-embeddings/data-uri-embeddings/security-validation.md) — Ensures inline data URIs use safe image formats through MIME type and encoding verification. ([source](https://github.com/microcosm-cc/bluemonday)) ### Part of an Awesome List - [Text Processing](https://awesome-repositories.com/f/awesome-lists/devtools/text-processing.md) — HTML sanitizer for preventing XSS attacks.