search

microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
https://github.com/microcosm-cc/bluemonday
BSD 3-Clause "New" or "Revised" License
3.08k stars 178 forks source link

Sanitize only what is disallowed #159

Closed aviadl closed 1 year ago

aviadl commented 1 year ago

It seems that sanitization is working according to an allow list So basically everything is forbidden Is there a way to turn it around, i know it is less safe But in my case i would like to only remove iframes and scripts And leave all other elements (I can today with a regex) and attributes (couldn't find a way) in place ?

buro9 commented 1 year ago

This will not be changed in this project. The only way to be default safe is to build an allow list.

If a cosmetic thing is needed, rather than a security thing, then a different project should be created to achieve the inverse of this one. That is: to iterate through HTML and not output something on a block list.