Is there is .NET implementation of HtmlPurifier(php) [closed]

Question

Is there a comprehensive Html cleaner/Anti-Xss library for .NET that also has a defined whitelist. I know that Microsofts Anti-Xss is a good place to start, but it needs a good whitelist for allowed html tags and css. Does anyone know of something?

Sketch

Answer 1

What's wrong with Microsoft's Anti-XSS library (which you've mentioned)?

They've got comprehensive HTML sanitizing that filters the characters based on a white list, parses the HTML, filters the nodes based on a white-list, and then regenerates the (safe) HTML. You can change the white lists (since the code is open), but I'm not sure you'd want to.

Usage is simple too:

var sanitizedHtml = Microsoft.Security.Application.Sanitizer.GetSafeHtmlFragment(inputHtml);

Rees

That's very cool! I've been writing my own cheesy sanitizer... no more! – Jedthus

Unfortunately AntiXSS Library release process is quite unfriendly. Release 4.2.1 has introduced massive unexpected breaking changes, there is no timeline for a fix and no source to fork. Not something you want to rely upon. – Datum

Answer 2

According to MSDN (see "Allowing Restricted HTML Input") the best way to sanitize HTML input is to call HttpUtility.HtmlEncode() on your input and then selectively replace the encoding on all your whitelist tags like so:

<%@ Page Language="C#" ValidateRequest="false"%>    
<script runat="server">    
  void submitBtn_Click(object sender, EventArgs e)
  {
    // Encode the string input
    StringBuilder sb = new StringBuilder(
                            HttpUtility.HtmlEncode(htmlInputTxt.Text));
    // Selectively allow  and <i>
    sb.Replace("&lt;b&gt;", "<b>");
    sb.Replace("&lt;/b&gt;", "");
    sb.Replace("&lt;i&gt;", "<i>");
    sb.Replace("&lt;/i&gt;", "");
    Response.Write(sb.ToString());
  }
</script>

See also this article.

Nye

This content is outdated and is no longer being maintained. 12 out of 200 users found it helpful. – Datum