Awesome-go: Should sanitize Markdown when rendering.

[dmitshur]

See https://github.com/avelino/awesome-go/pull/1127#discussion_r82932502. It still hasn't been done.

You should sanitize the output from blackfriday, just in case someone sneaks a malicious piece of user content and we accidentally merge it.

See https://github.com/russross/blackfriday#sanitize-untrusted-content.

Blackfriday README says:

Sanitize untrusted content

Blackfriday itself does nothing to protect against malicious content. If you are
dealing with user-supplied markdown, we recommend running blackfriday's output
through HTML sanitizer such as
Bluemonday.

Here's an example of simple usage of blackfriday together with bluemonday:

import (
    "github.com/microcosm-cc/bluemonday"
    "github.com/russross/blackfriday"
)

// ...
unsafe := blackfriday.MarkdownCommon(input)
html := bluemonday.UGCPolicy().SanitizeBytes(unsafe)

[avelino]

@shurcooL you can send the fix?

[kirillDanshin]

@avelino I've just committed the fix, pushing.

[kirillDanshin]

@avelino done

[felipeweb]

@kirillDanshin the tests now are broken because you missing a dependency

[kirillDanshin]

@felipeweb whoops! thanks, accidentally didn't git add it. fixed.

[dmitshur]

This was resolved by https://github.com/avelino/awesome-go/commit/7cee227b4a92e309127e315afa0b153934f6b6a4?w=1, closing.

Thanks @kirillDanshin.