OWASP policy

public static String sanitizeHTML(String html) {
        PolicyFactory htmlSanitizer = Sanitizers.FORMATTING
            .and(Sanitizers.LINKS)
            .and(Sanitizers.BLOCKS)
            .and(Sanitizers.IMAGES)
            .and(Sanitizers.TABLES)
            .and(new HtmlPolicyBuilder().allowElements(new ElementPolicy() {
                public String apply(String elementName, List<String> attrs) {
                    // force a target="_blank" on all links
                    if ("a".equals(elementName)) {
                        attrs.add("target");
                        attrs.add("_blank");
                    }
                    return elementName;
                }
            }, "const", "var", "action", "keyword",
                "a",
                "track",
                "article",
                "aside",
                "header",
                "hgroup",
                "hr",
                "footer",
                "nav",
                "section",
                "summary",
                "details",
                "base",
                "basefont",
                "span",
                "title",
                "button",
                "datalist",
                "form",
                "keygen",
                "label",
                "input",
                "legend",
                "fieldset",
                "meter",
                "optgroup",
                "option",
                "select",
                "textarea",
                "abbr",
                "acronym",
                "address",
                "bdi",
                "bdo",
                "center",
                "cite",
                "del",
                "dfn",
                "kbd",
                "mark",
                "output",
                "progress",
                "q",
                "rp",
                "rt",
                "ruby",
                "samp",
                "wbr",
                "dd",
                "dir",
                "dl",
                "dt",
                "menu",
                "area",
                "figcaption",
                "figure",
                "map",
                "param",
                "source",
                "audio",
                "time",
                "video"
            )
                .allowWithoutAttributes("span")
                .allowAttributes("class", "colspan").globally()
                .allowStandardUrlProtocols()
                .allowStyling()
                .allowUrlsInStyles(AttributePolicy.IDENTITY_ATTRIBUTE_POLICY)
                .requireRelNofollowOnLinks()
                .toFactory()
            );
        return htmlSanitizer.sanitize(html);
    }