Hacker GitHub

← All repos

microcosm-cc/bluemonday

View on GitHub ↗ ★ 3,729 Go

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS

18 mentions on Hacker News by 5 people: 3 stories, 15 comments · first 2013-11-20 · latest 2024-07-14

Mentions per year 18 mentions · busiest year 2014 (3)
20082026
AllStoriesComments NewestTopOldest
  1. I store the raw input in my database, but run it through bluemonday before rendering it. Simples. https://github.com/microcosm-cc/bluemonday
    comment by buro9 · 2024-07-14 · in Don’t try to sanitize input, escape output (2020)
  2. …happy to hand over the reigns to a group of engineers that can focus on OSS. I am the author of https://github.com/microcosm-cc/bluemonday but being a maintainer is a journey, you make a tool for yourself, you realise others will benefit…
    comment by buro9 · 2024-07-08 · in Geomys, a blueprint for a sustainable open-source maintenance firm
  3. …which you use when you have user generated / untrusted input that you need to display as HTML. https://github.com/microcosm-cc/bluemonday For me the library has been good enough for my own use for a very very long time. I mostly neglect it…
    comment by buro9 · 2023-04-11 · in Sponsor the open source projects you depend on
  4. ▲ 1
    Bluemonday: A fast Golang HTML sanitizer
    story by memorable · 2022-05-29 · 0 comments
  5. My thoughts as a maintainer of a HTML sanitizer in Go https://github.com/microcosm-cc/bluemonday which is also available to Python via https://github.com/ColdHeat/pybluemonday 1. Sanitizing is not difficult, defining the policy/config is.…
    comment by buro9 · 2021-05-06 · in HTML Sanitizer API
  6. …someone else but also looking for any feedback. Especially about how the bindings were written. [1] https://github.com/microcosm-cc/bluemonday [2] https://github.com/ColdHeat/pybluemonday#performance
    comment by ColdHeat · 2020-12-14 · in Show HN: Fast HTML Sanitization in Python
  7. Out of curiosity, I fed the attacks to the Go bluemonday library https://github.com/microcosm-cc/bluemonday It seemed to have no issues whatsoever (click Run): https://play.golang.org/p/oBYXo9MDusr https://play.golang.org/p/KzD1Ug-KKiB
    comment by yencabulator · 2020-10-08 · in DOMPurify bypass: XSS via HTML namespace confusion
  8. …And then other miscellaneous things: The Go HTML sanitizer for user generated content https://github.com/microcosm-cc/bluemonday Our legal policies for forums on this platform (expensive to produce, but perfectly fitting a forum platform…
    comment by buro9 · 2019-09-22 · in Almost one in five men admits to having no close friends, a survey has found
  9. ▲ 1
    Bluemonday: a fast HTML sanitizer to scrub user generated content of XSS
    story by majke · 2017-12-22 · 0 comments
  10. This didn't work so well for one of my projects: https://github.com/microcosm-cc/bluemonday I chose to look at this one as the README is quite descriptive and offers examples, and it is reasonably well structured. It's a Go HTML sanitizer.…
    comment by buro9 · 2017-08-30 · in Topic Suggestions for Millions of Repositories
  11. …web coding practices for Go I always look up an area that I know best: sanitization. I wrote https://github.com/microcosm-cc/bluemonday which is a pure Go HTML sanitizer inspired by https://github.com/owasp/java-html-sanitizer . The key…
    comment by buro9 · 2017-06-23 · in Go Language – Web Application Secure Coding Practices
  12. …Whitelist only trusted schemes, do not wait to blacklist untrusted. I wrote the Go HTML sanitizer: https://github.com/microcosm-cc/bluemonday and have a rule for user generated (untrusted) content that basically does whitelist just the…
    comment by buro9 · 2016-09-12 · in If your code accepts URIs as input, filter out “file://”
  13. …not give any examples. In the aversion to use any non-standard package it also does not mention https://github.com/microcosm-cc/bluemonday or anything similar (I am the author of bluemonday - a HTML sanitizer in the same vein as the OWASP…
    comment by buro9 · 2016-03-28 · in Building Web Apps in Go
  14. …for user content, this is passed through a Go library I wrote to strip out iframes, embeds, etc... https://github.com/microcosm-cc/bluemonday and then as a post-processing task once I trust the content, I find the links that I know how to…
    comment by buro9 · 2015-06-12 · in Securing access to Wikimedia sites with HTTPS by default
  15. …text input into HTML, though there is a missing dependency here which is Bluemonday. Bluemonday ( https://github.com/microcosm-cc/bluemonday ) is a HTML sanitizer and ensures that XSS supplied via the Markdown box is stripped before…
    comment by buro9 · 2014-10-13 · in Building Web Apps with Go
  16. …the policy, simplistic URL checking, etc). I ended up writing my own package to help fill the gap https://github.com/microcosm-cc/bluemonday You can tell I'm dealing with user generated/supplied content. Each domain still feels almost…
    comment by buro9 · 2014-07-06 · in A curated list of Go frameworks, libraries and software
  17. ▲ 3
    Bluemonday: a fast golang HTML sanitizer to help sanitize user generated content
    story by buro9 · 2014-06-11 · 0 comments
  18. Thanks to a fellow HN reader, we now have a head start on trying to create a HTML sanitizer. https://github.com/microcosm-cc/bluemonday Feel free to use it and help out. Initial work was all done by Matt Jibson as part of his Google Reader…
    comment by buro9 · 2013-11-20 · in On Go’s Web Application Ecosystem