microcosm-cc/bluemonday
View on GitHub ↗ ★ 3,729 Go
bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
18 mentions on Hacker News by 5 people: 3 stories, 15 comments · first 2013-11-20 · latest 2024-07-14
20082026
-
I store the raw input in my database, but run it through bluemonday before rendering it. Simples. https://github.com/microcosm-cc/bluemonday
comment by buro9 · 2024-07-14 · in Don’t try to sanitize input, escape output (2020) -
…happy to hand over the reigns to a group of engineers that can focus on OSS. I am the author of https://github.com/microcosm-cc/bluemonday but being a maintainer is a journey, you make a tool for yourself, you realise others will benefit…
comment by buro9 · 2024-07-08 · in Geomys, a blueprint for a sustainable open-source maintenance firm -
…which you use when you have user generated / untrusted input that you need to display as HTML. https://github.com/microcosm-cc/bluemonday For me the library has been good enough for my own use for a very very long time. I mostly neglect it…
comment by buro9 · 2023-04-11 · in Sponsor the open source projects you depend on -
My thoughts as a maintainer of a HTML sanitizer in Go https://github.com/microcosm-cc/bluemonday which is also available to Python via https://github.com/ColdHeat/pybluemonday 1. Sanitizing is not difficult, defining the policy/config is.…
comment by buro9 · 2021-05-06 · in HTML Sanitizer API -
…someone else but also looking for any feedback. Especially about how the bindings were written. [1] https://github.com/microcosm-cc/bluemonday [2] https://github.com/ColdHeat/pybluemonday#performance
comment by ColdHeat · 2020-12-14 · in Show HN: Fast HTML Sanitization in Python -
Out of curiosity, I fed the attacks to the Go bluemonday library https://github.com/microcosm-cc/bluemonday It seemed to have no issues whatsoever (click Run): https://play.golang.org/p/oBYXo9MDusr https://play.golang.org/p/KzD1Ug-KKiB
comment by yencabulator · 2020-10-08 · in DOMPurify bypass: XSS via HTML namespace confusion -
…And then other miscellaneous things: The Go HTML sanitizer for user generated content https://github.com/microcosm-cc/bluemonday Our legal policies for forums on this platform (expensive to produce, but perfectly fitting a forum platform…
comment by buro9 · 2019-09-22 · in Almost one in five men admits to having no close friends, a survey has found -
This didn't work so well for one of my projects: https://github.com/microcosm-cc/bluemonday I chose to look at this one as the README is quite descriptive and offers examples, and it is reasonably well structured. It's a Go HTML sanitizer.…
comment by buro9 · 2017-08-30 · in Topic Suggestions for Millions of Repositories -
…web coding practices for Go I always look up an area that I know best: sanitization. I wrote https://github.com/microcosm-cc/bluemonday which is a pure Go HTML sanitizer inspired by https://github.com/owasp/java-html-sanitizer . The key…
comment by buro9 · 2017-06-23 · in Go Language – Web Application Secure Coding Practices -
…Whitelist only trusted schemes, do not wait to blacklist untrusted. I wrote the Go HTML sanitizer: https://github.com/microcosm-cc/bluemonday and have a rule for user generated (untrusted) content that basically does whitelist just the…
comment by buro9 · 2016-09-12 · in If your code accepts URIs as input, filter out “file://” -
…not give any examples. In the aversion to use any non-standard package it also does not mention https://github.com/microcosm-cc/bluemonday or anything similar (I am the author of bluemonday - a HTML sanitizer in the same vein as the OWASP…
comment by buro9 · 2016-03-28 · in Building Web Apps in Go -
…for user content, this is passed through a Go library I wrote to strip out iframes, embeds, etc... https://github.com/microcosm-cc/bluemonday and then as a post-processing task once I trust the content, I find the links that I know how to…
comment by buro9 · 2015-06-12 · in Securing access to Wikimedia sites with HTTPS by default -
…text input into HTML, though there is a missing dependency here which is Bluemonday. Bluemonday ( https://github.com/microcosm-cc/bluemonday ) is a HTML sanitizer and ensures that XSS supplied via the Markdown box is stripped before…
comment by buro9 · 2014-10-13 · in Building Web Apps with Go -
…the policy, simplistic URL checking, etc). I ended up writing my own package to help fill the gap https://github.com/microcosm-cc/bluemonday You can tell I'm dealing with user generated/supplied content. Each domain still feels almost…
comment by buro9 · 2014-07-06 · in A curated list of Go frameworks, libraries and software -
Thanks to a fellow HN reader, we now have a head start on trying to create a HTML sanitizer. https://github.com/microcosm-cc/bluemonday Feel free to use it and help out. Initial work was all done by Matt Jibson as part of his Google Reader…
comment by buro9 · 2013-11-20 · in On Go’s Web Application Ecosystem