I was inspired by this youtube video. https://www.youtube.com/watch?v=H1TVk3HhL9E to create my own XSS-fuzzer in golang. My plan is to call this function:

func is_allowed_html(text string) bool {

    tkn := html.NewTokenizer(strings.NewReader(text))

    for {

        tt := tkn.Next()

        switch {

        case tt == html.ErrorToken:
            return true
        case tt == html.StartTagToken:
            t := tkn.Token()
            if t.Data == "h1" {
                continue
            } else {
                return false
            }
        }
    }
}

(taken from here: https://gist.github.com/gregxsunday/4b08ea3f4b3961ac9cefcc3673b7c3c5) to detect if the golangs net/html library detects the tag as a <h1> tag, then if this html is detected as allowed by this function, then that html is passed to some function which parses the html as it would be parsed in a web browser like chrome. If this executes javascript, then there is a bug in the net/html library similar to the one shown in the youtube video.

My question is that is there a function in golang which parses a html string as it would be parsed in a browser and then also evaluates (possible) javascript XSS vectors? If there isn’t, then is there another way to accomplish this? I would like an efficient function, because fuzzing is quite performance critical, but anything will do. Something like the jsdom.JSDOM function in javascript looks nice, but… ya know… it is in javascript, not in golang: https://www.youtube.com/watch?v=gJGbS8UELGw&t=667s .

Thank you in advance!