テキストから HTML タグを除去する

This is a <strong>sample</strong> text
with <a href="#">HTML</a> tags.

package striptag

import (
    "html"
    "regexp"
)

// StripTagsRegexp removes all HTML tags from the input string and unescapes any HTML entities.
func StripTagsRegexp(s string) string {
    re := regexp.MustCompile(`<[^>]*>`)
    return html.UnescapeString(re.ReplaceAllString(s, ""))
}

package example

const (
    Text1 = `This is a <strong>sample</strong> text
with <a href="#">HTML</a> tags.`
)

//go:build ignore

package main

import (
    "striptag"
    "striptag/example"
)

func main() {
    println(striptag.StripTagsRegexp(example.Text1))
}

$ go run sample1a.go
This is a sample text
with HTML tags.

const (
    Text2 = `This is a <strong>sample</strong> text
with <a href="#">HTML</a> tags.<script>alert("XSS")</script>`
)

This is a sample text
with HTML tags.alert("XSS")

package striptag

import (
	"errors"
	"html"
	"io"
	"strings"

	ghtml "golang.org/x/net/html"
)

// skipTags defines the HTML tags whose content should be skipped when stripping tags.
var skipTags = map[string]bool{
	"script":   true,
	"style":    true,
	"noscript": true,
	"iframe":   true,
	"object":   true,
	"embed":    true,
	"textarea": true,
	"title":    true,
}

// StripTagsTokenizer removes HTML tags from the input string while skipping
// the content of certain tags defined in skipTags.
func StripTagsTokenizer(s string) (string, error) {
	tokenizer := ghtml.NewTokenizer(strings.NewReader(s))
	var b strings.Builder
	b.Grow(len(s))
	skipDepth := 0

	for {
		tt := tokenizer.Next() // get the next token type
		switch tt {
		case ghtml.ErrorToken: // handle error token
			if errors.Is(tokenizer.Err(), io.EOF) {
				return b.String(), nil // return the accumulated text at the end of input
			}
			return "", tokenizer.Err()
		case ghtml.StartTagToken: // handle start tag token
			t := tokenizer.Token()
			if skipTags[t.Data] {
				skipDepth++ // start skipping content of this tag
			}
		case ghtml.EndTagToken: // handle end tag token
			t := tokenizer.Token()
			if skipDepth > 0 && skipTags[t.Data] {
				skipDepth-- // stop skipping one level of skipped content
			}
		case ghtml.TextToken: // handle text token
			if skipDepth == 0 {
				b.WriteString(html.UnescapeString(string(tokenizer.Text())))
			}
		}
	}
}

//go:build ignore

package main

import (
	"fmt"
	"os"
	"striptag"
	"striptag/example"
)

func main() {
	out, err := striptag.StripTagsTokenizer(example.Text2)
	if err != nil {
		fmt.Fprintln(os.Stderr, err)
		return
	}
	fmt.Println(out)
}

$ go run sample2b.go
This is a sample text
with HTML tags.

// changeBrToNewline handles the <br> tag by converting it to a newline character in the output.
func changeBrToNewline(t ghtml.Token, b *strings.Builder) {
	if t.Data == "br" {
		// Handle <br> as a line break.
		b.WriteByte('\n')
	}
}

// StripTagsTokenizer removes HTML tags from the input string while skipping
// the content of certain tags defined in skipTags.
func StripTagsTokenizer(s string) (string, error) {
	tokenizer := ghtml.NewTokenizer(strings.NewReader(s))
	var b strings.Builder
	b.Grow(len(s))
	skipDepth := 0

	for {
		tt := tokenizer.Next() // get the next token type
		switch tt {
		case ghtml.ErrorToken: // handle error token
			if errors.Is(tokenizer.Err(), io.EOF) {
				return b.String(), nil // return the accumulated text at the end of input
			}
			return "", tokenizer.Err()
		case ghtml.StartTagToken: // handle start tag token
			t := tokenizer.Token()
			if skipTags[t.Data] {
				skipDepth++ // start skipping content of this tag
			}
			if skipDepth == 0 {
				changeBrToNewline(t, &b)
			}
		case ghtml.SelfClosingTagToken: // handle self-closing tag token
			t := tokenizer.Token()
			if skipDepth == 0 {
				changeBrToNewline(t, &b)
			}
		case ghtml.EndTagToken: // handle end tag token
			t := tokenizer.Token()
			if skipDepth > 0 && skipTags[t.Data] {
				skipDepth-- // stop skipping one level of skipped content
			}
		case ghtml.TextToken: // handle text token
			if skipDepth == 0 {
				b.WriteString(html.UnescapeString(string(tokenizer.Text())))
			}
		}
	}
}

const (
	Text3 = `This is a <strong>sample</strong> text<br>with <a href="#">HTML</a> tags.<script>alert("XSS")</script>`
)

This is a sample text
with HTML tags.