bluemonday
HTML sanitizer for Go that removes markup outside an allowlist from untrusted input, such as user generated content.
bluemonday is an HTML sanitizer for Go. It takes untrusted HTML, such as user generated content, and returns HTML limited to an allowlist of elements and attributes. A Go server builds a policy, either from the two policies the library ships or from its own rules, and applies it to each input. The library is installed with go get.
Worth knowing
The README asks that bluemonday run after any other HTML processing, such as Markdown rendering, so that no unsanitized markup is added later. Script and style elements are dropped unless the policy enables them.
Sources
- 2026-11-04: links, Written in, GitHub stars
api.github.com/repos/microcosm-cc/bluemonday - 2026-11-04: Maintainer, License, License model
raw.githubusercontent.com/microcosm-cc/bluemonday/main/LICENSE.md - 2026-11-04: Runtime, Categories, Install with
raw.githubusercontent.com/microcosm-cc/bluemonday/main/README.md - 2026-11-04: First release
proxy.golang.org/github.com/microcosm-cc/bluemonday/@v/v1.0.0.info - 2026-11-04: Current major version, Last release
proxy.golang.org/github.com/microcosm-cc/bluemonday/@v/v1.0.27.info - 2026-11-04: Contributors
api.github.com/repos/microcosm-cc/bluemonday/contributors?per_page=1