search

microcosm-cc / bluemonday

bluemonday: a fast golang HTML sanitizer (inspired by the OWASP Java HTML Sanitizer) to scrub user generated content of XSS
https://github.com/microcosm-cc/bluemonday
BSD 3-Clause "New" or "Revised" License
3.14k stars 176 forks source link

Links are stripped when they shouldn't #76

Closed ghost closed 5 years ago

ghost commented 5 years ago 
package main

import (
    "fmt"
    "github.com/microcosm-cc/bluemonday"
)

func main() {
    policy := bluemonday.NewPolicy()
    policy.AllowElements("div", "a")
    fmt.Println(policy.Sanitize(`<div><a href="/">link</a></div>`))
}

Output: <div>link</div>

I expect it to output <div><a>link</a></div>

ghost commented 5 years ago

Nevermind, adding policy.AllowNoAttrs().OnElements("a") solves the issue.