func HTMLAllowing(s string, args ...[]string) (string, error) {
	allowedTags := defaultTags
	if len(args) > 0 {
		allowedTags = args[0]
	}
	allowedAttributes := defaultAttributes
	if len(args) > 1 {
		allowedAttributes = args[1]
	}
	tokenizer := parser.NewTokenizer(strings.NewReader(s))
	buffer := bytes.NewBufferString("")
	ignore := ""
	for {
		tokenType := tokenizer.Next()
		token := tokenizer.Token()
		switch tokenType {
		case parser.ErrorToken:
			err := tokenizer.Err()
			if err == io.EOF {
				return buffer.String(), nil
			}
			return "", err
		case parser.StartTagToken:
			if len(ignore) == 0 && includes(allowedTags, token.Data) {
				token.Attr = cleanAttributes(token.Attr, allowedAttributes)
				buffer.WriteString(token.String())
			} else if includes(ignoreTags, token.Data) {
				ignore = token.Data
			}
		case parser.SelfClosingTagToken:
			if len(ignore) == 0 && includes(allowedTags, token.Data) {
				token.Attr = cleanAttributes(token.Attr, allowedAttributes)
				buffer.WriteString(token.String())
			} else if token.Data == ignore {
				ignore = ""
			}
		case parser.EndTagToken:
			if len(ignore) == 0 && includes(allowedTags, token.Data) {
				token.Attr = []parser.Attribute{}
				buffer.WriteString(token.String())
			} else if token.Data == ignore {
				ignore = ""
			}
		case parser.TextToken:
			if ignore == "" {
				buffer.WriteString(token.String())
			}
		case parser.CommentToken:
		case parser.DoctypeToken:
		default:
		}
	}
}
HTMLAllowing sanitizes html, allowing some tags.
Arrays of allowed tags and allowed attributes may optionally be passed as the second and third arguments.
package sanitize
import (
	"bytes"
	"html"
	"html/template"
	"io"
	"path"
	"regexp"
	"strings"
	parser "golang.org/x/net/html"
)
var (
	ignoreTags = []string{"title", "script", "style", "iframe", "frame", "frameset", "noframes", "noembed", "embed", "applet", "object", "base"}
	defaultTags = []string{"h1", "h2", "h3", "h4", "h5", "h6", "div", "span", "hr", "p", "br", "b", "i", "strong", "em", "ol", "ul", "li", "a", "img", "pre", "code", "blockquote"}
	defaultAttributes = []string{"id", "class", "src", "href", "title", "alt", "name", "rel"}
)