HtmlSanitizer Provides data for the event. Gets or sets the document. The document. Initializes a new instance of the class. Provides data for the event. Gets or sets the document. The document. Gets or sets the DOM node to be processed. The DOM node. Gets the replacement nodes. Leave empty if no replacement should occur. The replacement nodes. Initializes a new instance of the class. Provides data for the event. Gets or sets the tag to be removed. The tag. Gets or sets the reason why the tag will be removed The reason. Provides data for the event. Gets or sets the tag containing the attribute to be removed. The tag. Gets or sets the attribute to be removed. The attribute. Gets or sets the reason why the attribute will be removed The reason. Provides data for the event. Gets or sets the tag containing the style to be removed. The tag. Gets or sets the style to be removed. The style. Gets or sets the reason why the style will be removed The reason. Provides data for the event. Gets or sets the tag containing the at-rule to be removed. The tag. Gets or sets the rule to be removed. The rule. Provides data for the event. Gets or sets the comment node to be removed. The comment node. Provides data for the event. Gets or sets the tag containing the CSS class to be removed. The tag. Gets or sets the CSS class to be removed. The CSS class. Gets or sets the reason why the CSS class will be removed. The reason. Provides data for the event. Gets or sets the original URL. The original URL. Gets or sets the sanitized URL. The sanitized URL. If it is null, it will be removed. HTML5 markup formatter. Identical to except for < and > which are encoded in attribute values. An instance of . Cleans HTML documents and fragments from constructs that can lead to XSS attacks. XSS attacks can occur at several levels within an HTML document or fragment: HTML Tags (e.g. the <script> tag) HTML attributes (e.g. the "onload" attribute) CSS styles (url property values) malformed HTML or HTML that exploits parser bugs in specific browsers The HtmlSanitizer class addresses all of these possible attack vectors by using a sophisticated HTML parser (AngleSharp). In order to facilitate different use cases, HtmlSanitizer can be customized at the levels mentioned above: You can specify the allowed HTML tags through the property . All other tags will be stripped. You can specify the allowed HTML attributes through the property . All other attributes will be stripped. You can specify the allowed CSS property names through the property . All other styles will be stripped. You can specify the allowed URI schemes through the property . All other URIs will be stripped. You can specify the HTML attributes that contain URIs (such as "src", "href" etc.) through the property . alert('xss')
Test
"; var sanitized = sanitizer.Sanitize(html, "http://www.example.com"); // -> "
Test
" ]]> Initializes a new instance of the class. The allowed tag names such as "a" and "div". When null, uses The allowed HTTP schemes such as "http" and "https". When null, uses The allowed HTML attributes such as "href" and "alt". When null, uses The HTML attributes that can contain a URI such as "href". When null, uses The allowed CSS properties such as "font" and "margin". When null, uses CSS class names which are allowed in the value of a class attribute. When null, any class names are allowed. Gets or sets the default value indicating whether to keep child nodes of elements that are removed. Default is false. Gets or sets a value indicating whether to keep child nodes of elements that are removed. Default is . Gets or sets the default object that creates the parser used for parsing the input. Gets or sets the object the creates the parser used for parsing the input. Gets or sets the default object used for generating output. Default is . Gets or sets the object used for generating output. Default is . Gets or sets the allowed CSS at-rules such as "@media" and "@font-face". The allowed CSS at-rules. The default allowed CSS at-rules. Gets or sets the allowed HTTP schemes such as "http" and "https". The allowed HTTP schemes. The default allowed URI schemes. Gets or sets the allowed HTML tag names such as "a" and "div". The allowed tag names. The default allowed HTML tag names. Gets or sets the allowed HTML attributes such as "href" and "alt". The allowed HTML attributes. Allow all HTML5 data attributes; the attributes prefixed with data- The default allowed HTML attributes. Gets or sets the HTML attributes that can contain a URI such as "href". The URI attributes. The default URI attributes. Gets or sets the allowed CSS properties such as "font" and "margin". The allowed CSS properties. The default allowed CSS properties. Gets or sets a regex that must not match for legal CSS property values. The regex. Gets or sets the allowed CSS classes. The allowed CSS classes. Occurs after sanitizing the document and post processing nodes. Occurs for every node after sanitizing. Occurs before a tag is removed. Occurs before an attribute is removed. Occurs before a style is removed. Occurs before an at-rule is removed. Occurs before a comment is removed. Occurs before a CSS class is removed. Occurs when a URL is being sanitized. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. The default regex for disallowed CSS property values. Raises the event. The instance containing the event data. Raises the event. The instance containing the event data. Return all nested subnodes of a node. The root node. All nested subnodes. Sanitizes the specified HTML body fragment. If a document is given, only the body part will be returned. The HTML body fragment to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The formatter used to render the DOM. Using the if null. The sanitized HTML body fragment. Sanitizes the specified HTML body fragment. If a document is given, only the body part will be returned. The HTML body fragment to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The sanitized HTML Document. Sanitizes the specified HTML document. Even if only a fragment is given, a whole document will be returned. The HTML document to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The formatter used to render the DOM. Using the if null. The sanitized HTML document. Sanitizes the specified HTML document. Even if only a fragment is given, a whole document will be returned. The HTML document to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The formatter used to render the DOM. Using the if null. The sanitized HTML document. Creeates an instance of . An instance of . Removes all comment nodes from a list of nodes. The element within which to remove comments. true if any comments were removed; otherwise, false. Performs post processing on all nodes in the document. The HTML document. The element within which to post process all nodes. Determines whether the specified attribute can contain a URI. The attribute. true if the attribute can contain a URI; otherwise, false. Determines whether the specified tag is allowed. The tag. true if the tag is allowed; otherwise, false. Determines whether the specified attribute is allowed. The attribute. true if the attribute is allowed; otherwise, false. Sanitizes the style. The element. The base URL. Decodes CSS unicode escapes and removes comments. The CSS string. The decoded CSS string. Tries to create a safe object from a string. The URL. The object or null if no safe can be created. Sanitizes a URL. The URL. The base URL relative URLs are resolved against (empty or null for no resolution). The sanitized URL or null if no safe URL can be created. Removes a tag from the document. Tag to be removed Reason for removal Removes an attribute from the document. Tag the attribute belongs to Attribute to be removed Reason for removal Removes a style from the document. Tag the style belongs to Style rule that contains the style to be removed Style to be removed Reason for removal Removes an at-rule from the document. Tag the style belongs to Rule to be removed true, if the rule can be removed; false, otherwise. Removes a CSS class from a class attribute. Tag the style belongs to Class to be removed Reason for removal Enables an inheriting class to implement an HtmlSanitizer class, which cleans HTML documents and fragments from constructs that can lead to XSS attacks. Gets or sets a value indicating whether to keep child nodes of elements that are removed. Gets or sets the object the creates the parser used for parsing the input. Gets or sets the object used for generating output. Gets or sets the allowed CSS at-rules such as "@media" and "@font-face". The allowed CSS at-rules. Gets or sets the allowed HTTP schemes such as "http" and "https". The allowed HTTP schemes. Gets or sets the allowed HTML tag names such as "a" and "div". The allowed tag names. Gets or sets the allowed HTML attributes such as "href" and "alt". The allowed HTML attributes. Allow all HTML5 data attributes; the attributes prefixed with data- Gets or sets the HTML attributes that can contain a URI such as "href". The URI attributes. Gets or sets the allowed CSS properties such as "font" and "margin". The allowed CSS properties. Gets or sets a regex that must not match for legal CSS property values. The regex. Gets or sets the allowed CSS classes. The allowed CSS classes. Occurs after sanitizing the document and post processing nodes. Occurs for every node after sanitizing. Occurs before a tag is removed. Occurs before an attribute is removed. Occurs before a style is removed. Occurs before an at-rule is removed. Occurs before a comment is removed. Occurs before a CSS class is removed. Sanitizes the specified HTML. The HTML to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The formatter used to render the DOM. Using the default formatter if null. The sanitized HTML. Sanitizes the specified HTML body fragment. If a document is given, only the body part will be returned. The HTML body fragment to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The sanitized HTML Document. Sanitizes the specified HTML document. Even if only a fragment is given, a whole document will be returned. The HTML document to sanitize. The base URL relative URLs are resolved against. No resolution if empty. The formatter used to render the DOM. Using the if null. The sanitized HTML document. Represents an Internationalized Resource Identifier Gets or sets the value of the IRI. The value of the IRI. Gets a value indicating whether the IRI is absolute. true if the IRI is absolute; otherwise, false. Gets or sets the scheme of the IRI, e.g. http. The scheme of the IRI. List of reasons why something was identified to get removed from the HTML Tag is not allowed Attribute is not allowed Style is not allowed Value is a non-allowed or harmful url Value is not allowed or harmful CSS Class is not allowed The class attribute is empty The style attribute is empty