Bleach

Bleach is Mozilla’s allowlist-based HTML sanitizer: it escapes or strips markup and attributes that aren’t explicitly permitted, rather than trying to blocklist dangerous patterns. It’s built on html5lib for browser-accurate HTML parsing, so it handles unbalanced or mis-nested tags in untrusted input the same way a real browser would, and it can safely linkify plain text into anchor tags with configurable rel attributes.

As of June 2026, the Bleach maintainers have announced the project is no longer maintained, including for security issues, and point users toward Rust-backed alternatives such as nh3. It remains widely deployed and its source stays available on GitHub, so it’s documented here as-is for teams maintaining existing integrations or evaluating a migration path.

What You Get

• bleach.clean() for allowlist-based sanitization of tags, attributes, and protocols
• bleach.linkify() for safely converting plain-text URLs and emails into anchor tags
• A Cleaner/Linker class-based API for reusable, configured sanitizer instances
• Optional CSS property sanitization via css_sanitizer.py for inline style attributes
• Browser-accurate HTML5 parsing (via html5lib) that correctly handles malformed/mis-nested markup

Common Use Cases

• Sanitizing user-submitted comments, forum posts, or wiki content before rendering as HTML
• Stripping disallowed tags/attributes from rich-text editor output before storage or display
• Auto-linkifying plain-text URLs in user content while controlling rel/target attributes
• Cleaning HTML email bodies before displaying them inline in a web app

Under The Hood

Architecture: bleach/sanitizer.py implements the Cleaner class, which drives an html5lib tree-walker/serializer pipeline configured with allowlists for tags, attributes, and protocols; bleach/linkifier.py implements a separate Linker/LinkifyFilter pass for text-to-anchor conversion, and bleach/html5lib_shim.py vendors compatibility shims over html5lib internals the library depends on directly (the package even vendors a _vendor copy of html5lib to pin exact parsing behavior).

Tech Stack: Pure Python with a hard dependency on html5lib for spec-compliant HTML5 parsing; a vendored copy under bleach/_vendor insulates the sanitizer from upstream html5lib API changes, at the cost of needing to be updated manually for html5lib security fixes — a factor the maintainers cite in their deprecation notice.

Code Quality: Seven dedicated test modules (tests/test_clean.py, tests/test_linkify.py, tests/test_css.py, etc.) exercise allowlist edge cases, malformed-HTML handling, and linkify corner cases; the README explicitly documents a responsible security-disclosure process reflecting its history as a security-critical dependency across the Python web ecosystem.

API Design: The API is intentionally small and function-first — bleach.clean(text, tags=..., attributes=...) and bleach.linkify(text) cover the overwhelming majority of use cases in one call, with the Cleaner/Linker classes available only when an application needs to reuse the same configuration repeatedly without re-specifying allowlists.