Consistently raise minimum Go version and update CI

go.mod already requires Go 1.19.

.github/workflows/test.yml

@@ -1,29 +1,24 @@
 on: [push, pull_request]
+permissions:
+  contents: read
 name: Test
 jobs:
   test:
     strategy:
       fail-fast: false
       matrix:
-        go-version: [1.19.x, 1.20.x]
+        go: [1.19.x, 1.x]
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
+    - name: Install Go ${{ matrix.go }}
+      uses: actions/setup-go@v5
       with:
-        go-version: ${{ matrix.go-version }}
+        go-version: ${{ matrix.go }}
     - name: Checkout code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
+      with:
+        fetch-depth: 0
     - name: Test
-      run: go test -v ./...
+      run: go test -v -race ./...
 
-  check:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Install Go
-      uses: actions/setup-go@v2
-      with:
-        go-version: 1.20.x
-    - name: Checkout code
-      uses: actions/checkout@v2

README.md

@@ -56,14 +56,6 @@ The policy containing the allowlist is applied using a fast non-validating, forw
 
 We expect to be supplied with well-formatted HTML (closing elements for every applicable open element, nested correctly) and so we do not focus on repairing badly nested or incomplete HTML. We focus on simply ensuring that whatever elements do exist are described in the policy allowlist and that attributes and links are safe for use on your web page. [GIGO](http://en.wikipedia.org/wiki/Garbage_in,_garbage_out) does apply and if you feed it bad HTML bluemonday is not tasked with figuring out how to make it good again.
 
-### Supported Go Versions
-
-bluemonday is tested on all versions since Go 1.2 including tip.
-
-We do not support Go 1.0 as we depend on `golang.org/x/net/html` which includes a reference to `io.ErrNoProgress` which did not exist in Go 1.0.
-
-We support Go 1.1 but Travis no longer tests against it.
-
 ## Is it production ready?
 
 *Yes*

sanitize.go

@@ -1087,3 +1087,8 @@ func normaliseElementName(str string) string {
 		`"`,
 	)
 }
+
+type stringWriterWriter interface {
+	io.Writer
+	io.StringWriter
+}

sanitize_test.go

@@ -4038,3 +4038,39 @@ xss`
 			expected)
 	}
 }
+
+func TestXSSGo18(t *testing.T) {
+	p := UGCPolicy()
+
+	tests := []test{
+		{
+			in:       `<IMG SRC="jav&#x0D;ascript:alert('XSS');">`,
+			expected: ``,
+		},
+		{
+			in:       "<IMG SRC=`javascript:alert(\"RSnake says, 'XSS'\")`>",
+			expected: ``,
+		},
+	}
+
+	// These tests are run concurrently to enable the race detector to pick up
+	// potential issues
+	wg := sync.WaitGroup{}
+	wg.Add(len(tests))
+	for ii, tt := range tests {
+		go func(ii int, tt test) {
+			out := p.Sanitize(tt.in)
+			if out != tt.expected {
+				t.Errorf(
+					"test %d failed;\ninput   : %s\noutput  : %s\nexpected: %s",
+					ii,
+					tt.in,
+					out,
+					tt.expected,
+				)
+			}
+			wg.Done()
+		}(ii, tt)
+	}
+	wg.Wait()
+}