htmlsanitizer

A fast, allowlist-based HTML sanitizer written in Go. Secure-by-default with a built-in allowlist that strips dangerous HTML content.

• Fast -- O(n) time complexity via an internal Finite State Machine
• Customizable -- modify the allowlist, add/remove tags, or disable all HTML
• Zero dependencies

Also available in Rust / npm: htmlsanitizer-rs

Install

go get github.com/sym01/htmlsanitizer

Usage

Basic

sanitizedHTML, err := htmlsanitizer.SanitizeString(rawHTML)

Disable the id attribute globally

s := htmlsanitizer.NewHTMLSanitizer()
s.GlobalAttr = []string{"class"}

sanitizedHTML, err := s.SanitizeString(rawHTML)

Add or remove tags

s := htmlsanitizer.NewHTMLSanitizer()
// remove <a> tag
s.RemoveTag("a")

// add a custom tag
s.AllowList.Tags = append(s.AllowList.Tags, &htmlsanitizer.Tag{
    Name: "my-tag",
    Attr: []string{"my-attr"},
})

sanitizedHTML, err := s.SanitizeString(rawHTML)

Strip all HTML

s := htmlsanitizer.NewHTMLSanitizer()
s.AllowList = nil

sanitizedHTML, err := s.SanitizeString(rawHTML)

Testing

go test ./...              # run tests
go test -race ./...        # with race detection
go test -bench=. -benchmem ./...  # benchmarks
go test -fuzz=FuzzSanitize -fuzztime=30s .  # fuzz testing