bleach is deprecated; statement on project going forward (2023-01-23)

[willkg]

Summary

As of now, Bleach is deprecated.

We will continue to support Bleach:

1. security updates
2. support for new Python versions
3. fixes for egregious bugs

I figure that's one release a year or something like that.

Why?

Bleach sits on top of--and heavily relies on--html5lib which is no longer in active development. It is increasingly difficult to maintain Bleach in that context and I think it's nuts to build a security library on top of a library that's not in active development. There are some options (switch to something else, take over html5lib, etc), I don't particularly like any of them. I think instead, someone new should explore the options with a brand new library and a fresh start.

Update: 2026-06-05

Bleach 6.4.0 is the final release of Bleach. There will be no future releases including for Python support or security fixes. Thank you for using and contributing to Bleach!

[hugovk]

Thank you for all your work on Bleach, and for announcing this clearly and with plenty of notice!

[Lukas-J]

Hi @willkg ,
It seems there is some activity going on in html5lib. So maybe not all hope is lost for bleach. Is there any way it could become un-deprecated sometime?

If not, I'm struggling finding a suitable replacement for bleach to be honest. Does someone have recommendations to safely sanitize html user input?

Cheers!

[g1-1-1]

Hi @willkg , It seems there is some activity going on in html5lib. So maybe not all hope is lost for bleach. Is there any way it could become un-deprecated sometime?

If not, I'm struggling finding a suitable replacement for bleach to be honest. Does someone have recommendations to safely sanitize html user input?

Cheers!

ammonia has a python binder you can use with similar features + faster speeds

[jsocol]

Thank you, @willkg, for your stewardship of Bleach for so long—much longer than I had it or than I bet you expected to 😅

And thank you to all of the other contributors over the past dozen years. It's still amazing to me to see how much this project spread and influenced other libraries. nh3/ammonia look like fantastic, fast alternatives built on a rock solid foundation in html5ever.

[qyryq]

What do people think about https://lxml.de/api/lxml.html.clean.Cleaner-class.html ?

Update: this comment links to docs which says:

the HTML Cleaner in lxml.html.clean is not considered appropriate for security sensitive environments. See e.g. bleach for an alternative.

There are 9 CVEs mentioning lxml and 5 of them mention clean.

The Cleaner class has allow_tags and safe_attrs parameters, so it could be used as an allowlist-based sanitizer, IIUC.

Web browser developers are also working on https://wicg.github.io/sanitizer-api/. Chromium already has it. And Firefox has it behind a flag (https://caniuse.com/mdn-api_sanitizer). It's obviously far from being a Python package, but if security is our main concern, what is going to be more robust than a sanitizer built into a web browser?

[willkg]

Update: I just pushed out Bleach 6.1.0 which drops Python 3.7 support, picks up Python 3.12 support, and fixes a handful of issues. I also closed out a lot of old issues and issues for things we're not going to fix.

I will continue fixing security issues as they come up.

Barring anything exciting, I'll probably do the next release when Python releases 3.13.

[aclark4life]

@willkg Could this library or html5lib-python benefit from any "lifting efforts" as provided by Tidelift? E.g. https://tidelift.com/subscription/pkg/pypi-pillow. I am potentially looking for something new to "lift"… thanks for any info or guidance towards where to put my efforts.

[kylepollina]

As of January 2024 there have been 3 commits to the htlm5lib repo: https://github.com/html5lib/html5lib-python/commits/master/

The html5lib is not entirely dead

[Alex3917]

FWIW, I tried nh3 as a replacement and found it to be unusable. I reported one issue here, but I've also found others that are at least as severe and probably much harder to fix:

messense/nh3#36

There also don't seem to be any Python libraries for linkifying HTML documents, only markdown. I understand why maintaining this library is problematic, but the functionality it provides is essential and there doesn't seem to be any viable replacement right now for either sanitization or linkification. I don't know what the right answer is, but wanted to share my experience since I've now put a few hours into trying to find a viable replacement for each set of functionality.

[simonw]

html5lib does have active maintainers at the moment: see this discussion thread for details html5lib/html5lib-python#560

[MikeHiett]

As @Alex3917 mentions, I've also tried implementing nh3 and the allowlists for tags and attributes does not work as described by the doucmentation for anyone who also may stumble into this problem