+Jibber Jabber is a GoLang Library that can be used to detect an operating system's current language.
+
+### OS Support
+
+OSX and Linux via the `LC_ALL` and `LANG` environment variables. These are standard variables that are used in ALL versions of UNIX for language detection.
+
+Windows via [GetUserDefaultLocaleName](http://msdn.microsoft.com/en-us/library/windows/desktop/dd318136.aspx) and [GetSystemDefaultLocaleName](http://msdn.microsoft.com/en-us/library/windows/desktop/dd318122.aspx) system calls. These calls are supported in Windows Vista and up.
+
+# Usage
+Add the following line to your go `import`:
+
+```
+ "github.com/cloudfoundry/jibber_jabber"
+```
+
+### DetectIETF
+`DetectIETF` will return the current locale as a string. The format of the locale will be the [ISO 639](http://en.wikipedia.org/wiki/ISO_639) two-letter language code, a DASH, then an [ISO 3166](http://en.wikipedia.org/wiki/ISO_3166-1) two-letter country code.
+
+```
+ userLocale, err := jibber_jabber.DetectIETF()
+ println("Locale:", userLocale)
+```
+
+### DetectLanguage
+`DetectLanguage` will return the current languge as a string. The format will be the [ISO 639](http://en.wikipedia.org/wiki/ISO_639) two-letter language code.
+`DetectTerritory` will return the current locale territory as a string. The format will be the [ISO 3166](http://en.wikipedia.org/wiki/ISO_3166-1) two-letter country code.
+# getpasswd in Go [](https://godoc.org/github.com/howeyc/gopass) [](http://travis-ci.org/howeyc/gopass)
+
+Retrieve password from user terminal or piped input without echo.
+
+Verified on BSD, Linux, and Windows.
+
+Example:
+```go
+package main
+
+import "fmt"
+import "github.com/howeyc/gopass"
+
+func main() {
+ fmt.Printf("Password: ")
+
+ // Silent. For printing *'s use gopass.GetPasswdMasked()
+ pass, err := gopass.GetPasswd()
+ if err != nil {
+ // Handle gopass.ErrInterrupted or getch() read error
+Third-party patches are essential for keeping bluemonday secure and offering the features developers want. However there are a few guidelines that we need contributors to follow so that we can maintain the quality of work that developers who use bluemonday expect.
+
+## Getting Started
+
+* Make sure you have a [Github account](https://github.com/signup/free)
+
+## Guidelines
+
+1. Do not vendor dependencies. As a security package, were we to vendor dependencies the projects that then vendor bluemonday may not receive the latest security updates to the dependencies. By not vendoring dependencies the project that implements bluemonday will vendor the latest version of any dependent packages. Vendoring is a project problem, not a package problem. bluemonday will be tested against the latest version of dependencies periodically and during any PR/merge.
+
+## Submitting an Issue
+
+* Submit a ticket for your issue, assuming one does not already exist
+* Clearly describe the issue including the steps to reproduce (with sample input and output) if it is a bug
+
+If you are reporting a security flaw, you may expect that we will provide the code to fix it for you. Otherwise you may want to submit a pull request to ensure the resolution is applied sooner rather than later:
+
+* Fork the repository on Github
+* Issue a pull request containing code to resolve the issue
+
+## Submitting a Pull Request
+
+* Submit a ticket for your issue, assuming one does not already exist
+* Describe the reason for the pull request and if applicable show some example inputs and outputs to demonstrate what the patch does
+* Fork the repository on Github
+* Before submitting the pull request you should
+ 1. Include tests for your patch, 1 test should encapsulate the entire patch and should refer to the Github issue
+ 1. If you have added new exposed/public functionality, you should ensure it is documented appropriately
+ 1. If you have added new exposed/public functionality, you should consider demonstrating how to use it within one of the helpers or shipped policies if appropriate or within a test if modifying a helper or policy is not appropriate
+ 1. Run all of the tests `go test -v ./...` or `make test` and ensure all tests pass
+ 1. Run gofmt `gofmt -w ./$*` or `make fmt`
+ 1. Run vet `go tool vet *.go` or `make vet` and resolve any issues
+ 1. Install golint using `go get -u github.com/golang/lint/golint` and run vet `golint *.go` or `make lint` and resolve every warning
+* When submitting the pull request you should
+ 1. Note the issue(s) it resolves, i.e. `Closes #6` in the pull request comment to close issue #6 when the pull request is accepted
+
+Once you have submitted a pull request, we *may* merge it without changes. If we have any comments or feedback, or need you to make changes to your pull request we will update the Github pull request or the associated issue. We expect responses from you within two weeks, and we may close the pull request is there is no activity.
+
+### Contributor Licence Agreement
+
+We haven't gone for the formal "Sign a Contributor Licence Agreement" thing that projects like [puppet](https://cla.puppetlabs.com/), [Mojito](https://developer.yahoo.com/cocktails/mojito/cla/) and companies like [Google](http://code.google.com/legal/individual-cla-v1.0.html) are using.
+
+But we do need to know that we can accept and merge your contributions, so for now the act of contributing a pull request should be considered equivalent to agreeing to a contributor licence agreement, specifically:
+
+You accept that the act of submitting code to the bluemonday project is to grant a copyright licence to the project that is perpetual, worldwide, non-exclusive, no-charge, royalty free and irrevocable.
+
+You accept that all who comply with the licence of the project (BSD 3-clause) are permitted to use your contributions to the project.
+
+You accept, and by submitting code do declare, that you have the legal right to grant such a licence to the project and that each of the contributions is your own original creation.
+bluemonday is a HTML sanitizer implemented in Go. It is fast and highly configurable.
+
+bluemonday takes untrusted user generated content as an input, and will return HTML that has been sanitised against a whitelist of approved HTML elements and attributes so that you can safely include the content in your web page.
+
+If you accept user generated content, and your server uses Go, you **need** bluemonday.
+
+The default policy for user generated content (`bluemonday.UGCPolicy().Sanitize()`) turns this:
+It protects sites from [XSS](http://en.wikipedia.org/wiki/Cross-site_scripting) attacks. There are many [vectors for an XSS attack](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet) and the best way to mitigate the risk is to sanitize user input against a known safe list of HTML elements and attributes.
+
+You should **always** run bluemonday **after** any other processing.
+
+If you use [blackfriday](https://github.com/russross/blackfriday) or [Pandoc](http://johnmacfarlane.net/pandoc/) then bluemonday should be run after these steps. This ensures that no insecure HTML is introduced later in your process.
+
+bluemonday is heavily inspired by both the [OWASP Java HTML Sanitizer](https://code.google.com/p/owasp-java-html-sanitizer/) and the [HTML Purifier](http://htmlpurifier.org/).
+
+## Technical Summary
+
+Whitelist based, you need to either build a policy describing the HTML elements and attributes to permit (and the `regexp` patterns of attributes), or use one of the supplied policies representing good defaults.
+
+The policy containing the whitelist is applied using a fast non-validating, forward only, token-based parser implemented in the [Go net/html library](https://godoc.org/golang.org/x/net/html) by the core Go team.
+
+We expect to be supplied with well-formatted HTML (closing elements for every applicable open element, nested correctly) and so we do not focus on repairing badly nested or incomplete HTML. We focus on simply ensuring that whatever elements do exist are described in the policy whitelist and that attributes and links are safe for use on your web page. [GIGO](http://en.wikipedia.org/wiki/Garbage_in,_garbage_out) does apply and if you feed it bad HTML bluemonday is not tasked with figuring out how to make it good again.
+
+### Supported Go Versions
+
+bluemonday is tested against Go 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, and tip.
+
+We do not support Go 1.0 as we depend on `golang.org/x/net/html` which includes a reference to `io.ErrNoProgress` which did not exist in Go 1.0.
+
+## Is it production ready?
+
+*Yes*
+
+We are using bluemonday in production having migrated from the widely used and heavily field tested OWASP Java HTML Sanitizer.
+
+We are passing our extensive test suite (including AntiSamy tests as well as tests for any issues raised). Check for any [unresolved issues](https://github.com/microcosm-cc/bluemonday/issues?page=1&state=open) to see whether anything may be a blocker for you.
+
+We invite pull requests and issues to help us ensure we are offering comprehensive protection against various attacks via user generated content.
+
+## Usage
+
+Install in your `${GOPATH}` using `go get -u github.com/microcosm-cc/bluemonday`
+
+Then call it:
+```go
+package main
+
+import (
+ "fmt"
+
+ "github.com/microcosm-cc/bluemonday"
+)
+
+func main() {
+ // Do this once for each unique policy, and use the policy for the life of the program
+ // Policy creation/editing is not safe to use in multiple goroutines
+ p := bluemonday.UGCPolicy()
+
+ // The policy can then be used to sanitize lots of input and it is safe to use the policy in multiple goroutines
+If you are obsessed about performance, `p.SanitizeReader(r).Bytes()` will return a `[]byte` without performing any unnecessary casting of the inputs or outputs. Though the difference is so negligible you should never need to care.
+
+You can build your own policies:
+```go
+package main
+
+import (
+ "fmt"
+
+ "github.com/microcosm-cc/bluemonday"
+)
+
+func main() {
+ p := bluemonday.NewPolicy()
+
+ // Require URLs to be parseable by net/url.Parse and either:
+1. `bluemonday.StrictPolicy()` which can be thought of as equivalent to stripping all HTML elements and their attributes as it has nothing on its whitelist. An example usage scenario would be blog post titles where HTML tags are not expected at all and if they are then the elements *and* the content of the elements should be stripped. This is a *very* strict policy.
+2. `bluemonday.UGCPolicy()` which allows a broad selection of HTML elements and attributes that are safe for user generated content. Note that this policy does *not* whitelist iframes, object, embed, styles, script, etc. An example usage scenario would be blog post bodies where a variety of formatting is expected along with the potential for TABLEs and IMGs.
+
+## Policy Building
+
+The essence of building a policy is to determine which HTML elements and attributes are considered safe for your scenario. OWASP provide an [XSS prevention cheat sheet](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet) to help explain the risks, but essentially:
+
+1. Avoid anything other than the standard HTML elements
+1. Avoid `script`, `style`, `iframe`, `object`, `embed`, `base` elements that allow code to be executed by the client or third party content to be included that can execute code
+1. Avoid anything other than plain HTML attributes with values matched to a regexp
+
+Basically, you should be able to describe what HTML is fine for your scenario. If you do not have confidence that you can describe your policy please consider using one of the shipped policies such as `bluemonday.UGCPolicy()`.
+
+To create a new policy:
+```go
+p := bluemonday.NewPolicy()
+```
+
+To add elements to a policy either add just the elements:
+```go
+p.AllowElements("b", "strong")
+```
+
+Or add elements as a virtue of adding an attribute:
+```go
+// Not the recommended pattern, see the recommendation on using .Matching() below
+But that will not protect you as the regular expression is insufficient in this case to have prevented a malformed value doing something unexpected.
+
+We provide some additional global options for safely working with links.
+
+`RequireParseableURLs` will ensure that URLs are parseable by Go's `net/url` package:
+```go
+p.RequireParseableURLs(true)
+```
+
+If you have enabled parseable URLs then the following option will `AllowRelativeURLs`. By default this is disabled (bluemonday is a whitelist tool... you need to explicitly tell us to permit things) and when disabled it will prevent all local and scheme relative URLs (i.e. `href="localpage.html"`, `href="../home.html"` and even `href="//www.google.com"` are relative):
+```go
+p.AllowRelativeURLs(true)
+```
+
+If you have enabled parseable URLs then you can whitelist the schemes (commonly called protocol when thinking of `http` and `https`) that are permitted. Bear in mind that allowing relative URLs in the above option will allow for a blank scheme:
+```go
+p.AllowURLSchemes("mailto", "http", "https")
+```
+
+Regardless of whether you have enabled parseable URLs, you can force all URLs to have a rel="nofollow" attribute. This will be added if it does not exist, but only when the `href` is valid:
+```go
+// This applies to "a" "area" "link" elements that have a "href" attribute
+p.RequireNoFollowOnLinks(true)
+```
+
+We provide a convenience method that applies all of the above, but you will still need to whitelist the linkable elements for the URL rules to be applied to:
+An additional complexity regarding links is the data URI as defined in [RFC2397](http://tools.ietf.org/html/rfc2397). The data URI allows for images to be served inline using this format:
+We have provided a helper to verify the mimetype followed by base64 content of data URIs links:
+
+```go
+p.AllowDataURIImages()
+```
+
+That helper will enable GIF, JPEG, PNG and WEBP images.
+
+It should be noted that there is a potential [security](http://palizine.plynt.com/issues/2010Oct/bypass-xss-filters/) [risk](https://capec.mitre.org/data/definitions/244.html) with the use of data URI links. You should only enable data URI links if you already trust the content.
+
+We also have some features to help deal with user generated content:
+```go
+p.AddTargetBlankToFullyQualifiedLinks(true)
+```
+
+This will ensure that anchor `<a href="" />` links that are fully qualified (the href destination includes a host name) will get `target="_blank"` added to them.
+
+Additionally any link that has `target="_blank"` after the policy has been applied will also have the `rel` attribute adjusted to add `noopener`. This means a link may start like `<a href="//host/path"/>` and will end up as `<a href="//host/path" rel="noopener" target="_blank">`. It is important to note that the addition of `noopener` is a security feature and not an issue. There is an unfortunate feature to browsers that a browser window opened as a result of `target="_blank"` can still control the opener (your web page) and this protects against that. The background to this can be found here: [https://dev.to/ben/the-targetblank-vulnerability-by-example](https://dev.to/ben/the-targetblank-vulnerability-by-example)
+
+### Policy Building Helpers
+
+We also bundle some helpers to simplify policy building:
+```go
+
+// Permits the "dir", "id", "lang", "title" attributes globally
+p.AllowStandardAttributes()
+
+// Permits the "img" element and its standard attributes
+p.AllowImages()
+
+// Permits ordered and unordered lists, and also definition lists
+p.AllowLists()
+
+// Permits HTML tables and all applicable elements and non-styling attributes
+p.AllowTables()
+```
+
+### Invalid Instructions
+
+The following are invalid:
+```go
+// This does not say where the attributes are allowed, you need to add
+// .Globally() or .OnElements(...)
+// This will be ignored without error.
+p.AllowAttrs("value")
+
+// This does not say where the attributes are allowed, you need to add
+Both examples exhibit the same issue, they declare attributes but do not then specify whether they are whitelisted globally or only on specific elements (and which elements). Attributes belong to one or more elements, and the policy needs to declare this.
+
+## Limitations
+
+We are not yet including any tools to help whitelist and sanitize CSS. Which means that unless you wish to do the heavy lifting in a single regular expression (inadvisable), **you should not allow the "style" attribute anywhere**.
+
+It is not the job of bluemonday to fix your bad HTML, it is merely the job of bluemonday to prevent malicious HTML getting through. If you have mismatched HTML elements, or non-conforming nesting of elements, those will remain. But if you have well-structured HTML bluemonday will not break it.
+
+## TODO
+
+* Add support for CSS sanitisation to allow some CSS properties based on a whitelist, possibly using the [Gorilla CSS3 scanner](http://www.gorillatoolkit.org/pkg/css/scanner) - PRs welcome so long as testing covers XSS and demonstrates safety first
+* Investigate whether devs want to blacklist elements and attributes. This would allow devs to take an existing policy (such as the `bluemonday.UGCPolicy()` ) that encapsulates 90% of what they're looking for but does more than they need, and to remove the extra things they do not want to make it 100% what they want
+* Investigate whether devs want a validating HTML mode, in which the HTML elements are not just transformed into a balanced tree (every start tag has a closing tag at the correct depth) but also that elements and character data appear only in their allowed context (i.e. that a `table` element isn't a descendent of a `caption`, that `colgroup`, `thead`, `tbody`, `tfoot` and `tr` are permitted, and that character data is not permitted)
+
+## Development
+
+If you have cloned this repo you will probably need the dependency:
+
+`go get golang.org/x/net/html`
+
+Gophers can use their familiar tools:
+
+`go build`
+
+`go test`
+
+I personally use a Makefile as it spares typing the same args over and over whilst providing consistency for those of us who jump from language to language and enjoy just typing `make` in a project directory and watch magic happen.
+
+`make` will build, vet, test and install the library.
+
+`make clean` will remove the library from a *single* `${GOPATH}/pkg` directory tree
+
+`make test` will run the tests
+
+`make cover` will run the tests and *open a browser window* with the coverage report
+
+`make lint` will run golint (install via `go get github.com/golang/lint/golint`)
+
+## Long term goals
+
+1. Open the code to adversarial peer review similar to the [Attack Review Ground Rules](https://code.google.com/p/owasp-java-html-sanitizer/wiki/AttackReviewGroundRules)
+1. Raise funds and pay for an external security review
+The library covers our usage, but might not be comprehensive of the API. So we always welcome contributions and improvements from the community. Before sending pull requests, make sure you've done the following:
+ [](http://webchat.freenode.net/?channels=writeas) [](http://slack.write.as/)
+
+**impart** is a library for the final layer between the API and the consumer. It's used in the latest [Write.as](https://write.as) and [HTMLhouse](https://html.house) APIs.
+
+We're still in the early stages of development, so there may be breaking changes.
+
+## Example use
+
+```go
+package main
+
+import (
+ "fmt"
+ "github.com/writeas/impart"
+ "net/http"
+)
+
+type handlerFunc func(w http.ResponseWriter, r *http.Request) error
+
+func main() {
+ http.HandleFunc("/", handle(index))
+ http.ListenAndServe("127.0.0.1:8080", nil)
+}
+
+func index(w http.ResponseWriter, r *http.Request) error {
+ fmt.Fprintf(w, "Hello world!")
+
+ return nil
+}
+
+func handle(f handlerFunc) http.HandlerFunc {
+ return func(w http.ResponseWriter, r *http.Request) {
+ handleError(w, r, func() error {
+ // Do authentication...
+
+ // Handle the request
+ err := f(w, r)
+
+ // Log the request and result...
+
+ return err
+ }())
+ }
+}
+
+func handleError(w http.ResponseWriter, r *http.Request, err error) {
+ if err == nil {
+ return
+ }
+
+ if err, ok := err.(impart.HTTPError); ok {
+ impart.WriteError(w, err)
+ return
+ }
+
+ impart.WriteError(w, impart.HTTPError{http.StatusInternalServerError, "Internal server error :("})
+Saturday is a fork of [Blackfriday](https://github.com/russross/blackfriday) used on [Write.as](https://write.as).
+
+We love Markdown, but aren't a Markdown-only platform. So we've stripped out and modified redundant or potentially frustrating syntax in this library.
+
+## Changes
+
+* Made images and links behave like standard Markdown (now they won't render when there are spaces between label/alt-text and URL) 12db6e2f7ebcc5d6d88e5b330e4c6d88b577bc95
+* Only support atx-style headings 32843b3dfc510153e76d8f535a9084fc8e22245a
+// Copyright 2009 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package windows
+
+//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsyscall_windows.go eventlog.go service.go syscall_windows.go security_windows.go
+// NewCallback converts a Go function to a function pointer conforming to the stdcall calling convention.
+// This is useful when interoperating with Windows code requiring callbacks.
+// The argument is expected to be a function with with one uintptr-sized result. The function must not have arguments with size larger than the size of uintptr.
+func NewCallback(fn interface{}) uintptr {
+ return syscall.NewCallback(fn)
+}
+
+// NewCallbackCDecl converts a Go function to a function pointer conforming to the cdecl calling convention.
+// This is useful when interoperating with Windows code requiring callbacks.
+// The argument is expected to be a function with with one uintptr-sized result. The function must not have arguments with size larger than the size of uintptr.