Philiprehberger.HtmlSanitizer 0.2.1

Philiprehberger.HtmlSanitizer

Whitelist-based HTML sanitizer for XSS prevention with configurable allowed tags, attributes, and URL schemes.

Installation

dotnet add package Philiprehberger.HtmlSanitizer

Usage

using Philiprehberger.HtmlSanitizer;

var clean = Sanitizer.Sanitize("<b>Hello</b><script>alert('xss')</script>");
// "<b>Hello</b>"

var stripped = Sanitizer.StripAll("<p>Hello <b>world</b></p>");
// "Hello world"

Custom Options

using Philiprehberger.HtmlSanitizer;

var options = new SanitizerOptions
{
    AllowedTags = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "p", "b", "i" },
    AllowedAttributes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "class" },
    AllowedSchemes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "https" }
};

var clean = Sanitizer.Sanitize("<p class=\"info\"><a href=\"http://evil.com\">link</a></p>", options);
// "<p class=\"info\">link</p>"

CSS Class Whitelisting

using Philiprehberger.HtmlSanitizer;

var options = new SanitizerOptions
{
    AllowedAttributes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "class" },
    AllowedClasses = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "safe", "info" }
};

var clean = Sanitizer.Sanitize("<p class=\"safe danger info\">text</p>", options);
// "<p class=\"safe info\">text</p>"

Data Attribute Support

using Philiprehberger.HtmlSanitizer;

var options = new SanitizerOptions
{
    AllowedDataAttributes = new HashSet<string>(StringComparer.OrdinalIgnoreCase) { "data-id", "data-name" }
};

var clean = Sanitizer.Sanitize("<p data-id=\"42\" data-evil=\"bad\">text</p>", options);
// "<p data-id=\"42\">text</p>"

Sanitization Report

using Philiprehberger.HtmlSanitizer;

var result = Sanitizer.SanitizeWithReport("<b>ok</b><div onclick=\"evil()\">text</div>");
// result.SanitizedHtml == "<b>ok</b>text"
// result.Report.Removals contains entries for the removed <div> tag and onclick attribute
foreach (var removal in result.Report.Removals)
{
    Console.WriteLine($"{removal.Kind}: {removal.Name} - {removal.Reason}");
}

External Link Safety

using Philiprehberger.HtmlSanitizer;

var options = new SanitizerOptions
{
    ForceExternalLinkSafety = true
};

var clean = Sanitizer.Sanitize("<a href=\"https://example.com\">link</a>", options);
// "<a href=\"https://example.com\" target=\"_blank\" rel=\"noopener noreferrer\">link</a>"

API

Sanitizer

SanitizerOptions

SanitizationResult

SanitizationReport

SanitizationRemoval

Development

dotnet build src/Philiprehberger.HtmlSanitizer.csproj --configuration Release

Support

If you find this project useful:

⭐ Star the repo

🐛 Report issues

💡 Suggest features

❤️ Sponsor development

🌐 All Open Source Projects

💻 GitHub Profile

🔗 LinkedIn Profile

License

MIT