HTML Sanitizer for .NET

Question

I'm starting a project that will be public facing using asp.net mvc. I know there are about a billion php, python, and ruby html sanitizers out there, but does anyone have some pointers to anything good in .net? What are your experiences with what is out there? I know stackoverflow is a site done in asp.net that allows freeform HTML, what does it use?

Handicap

Does this answer your question? How to use C# to sanitize input on an html page? – Pimento

Answer 1

https://blog.stackoverflow.com/2008/06/safe-html-and-xss/

Didst

+1, but that links to a page full of refactorings by different people (I was hoping for something a little more release-like) – Handicap

Answer 2

HtmlSanitizer

Source: https://github.com/mganss/HtmlSanitizer

A fairly robust sanitizer. It understands and can clean inline styles, but doesn't have a parser that can deal with <style> blocks, so it strips them. It's certainly up to and probably beyond the level that Microsoft's AntiXSS was at, before it was abandoned.

Zosima

This sanitizer looks much better (at least from the documentation) than Microsoft's solution. – Fur

Answer 3

HtmlRuleSanitizer

Based on your question I have the following suggestions:

• You want to allow free form HTML, so you need a solution to be able to specify a set of tags, attributes and/or CSS classes which are allowed.
• By allowing free form HTML it is likely that you'll also have to deal with malformed HTML because users make errors (deliberate or not). You thus need a solution built on a tolerant parser such as the Html Agility Pack.
• You'll want to take a white listing approach because a black listing sanitizer does not protect your from any new HTML specifications. In addition it is very hard to guarantee that a black list covers all cases in the first place due to the size of the HTML specification.

I faced the same problem and built HtmlRuleSanitizer which is a white listing rule based HTML sanitizer on top of the Html Agility Pack.

Memberg

Answer 4

there is a c# version here

Bluebill

Answer 5

Here is one built by microsoft. http://wpl.codeplex.com/

var cleanHtml = Sanitizer.GetSafeHtml(unsafeHtml);

Aldo

This appears to be getting some really bad reviews so I wouldn't recommend it anymore. – Aldo

it doesn't work at all and didn't remove onmousover event from a Tag – Nobe

Answer 6

We can also use

AntiXss.GetSafeHtmlFragments

sanitize input by parsing the HTML fragment,to use this sanitizer for rich content to ensure that it does not content any harmful script and it is safe to be displayed on the browser.For the text input(not rich content) to use AntiXss.HtmlEncode or any other equivalent html encoder.Here is the Sample for rich content.

 string mal = "<IMG NAME = 'myPic' SRC = 'images / myPic.gif' onerror='alert(1)' onerror='alert(1) ><div bottommargin = 150 ondblclick = 'alert('double clicked!')' >< p > Double - click anywhere in the page.</p> </div> ";
                var cleanHtml = Sanitizer.GetSafeHtmlFragment(mal);
                Console.Write(cleanHtml);
                Console.Read(); 

Note: Download AntiXSS library fron nugetpackage manager and include this namesapce Microsoft.Security.Application in the souce code;

Wether

The sanitization method is is Microsoft.Security.ApplicationSanitizer.GetSafeHtmlFragment(string) .. And the Nuget can be installed by executing Install-Package AntiXSS in the Package Manager Console. – Abfarad

Is AntiXss deprecated today? – Typhogenic