microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
https://github.com/microcosm-cc/bluemonday
BSD 3-Clause "New" or "Revised" License
3.12k stars 176 forks source link

How to disallow emoji? #155

Closed ivanjaros closed 1 year ago

buro9 commented 1 year ago

I am not sure that is possible at all, let alone with bluemonday. Emojis are (I believe) indistinguishable from regular characters in many languages. Perhaps there is a specific unicode family that groups this and you can iterate over all of the runes in the text prior to sanitization and check the rune family and exclude them... but this is a task for you to do rather than for this library to do.