HTML sanitizer in ASP.NET MVC that filters dangerous markup, but allows the rest

asp.net-mvc asp.net-mvc-3 xss antixsslibrary wpl
vtortola picture vtortola · Dec 29, 2011 · Viewed 7.6k times · Source

I know that lot of questions about HTML sanitizers have appeared in SO, but I don't know if they do what I want, I have a little mess since some of the recommended approaches have more than 4 years old.

I have a page with the TinyMCE editor. Of course, this editor send HTML to the server, and expect HTML, so I have created a entity with a String property decorated with the [AllowHtml] attribute. It works well.

Now, I want to ensure that nobody tries to send a <script> tag, or a <img onerror="">, or whatever way of execute JS, or add CSS that point to external urls.

What is the best solution at the moment?

WPL has the HtmlSanitizationLibrary, but how can I know what tags are considered "secure"?

WPL has not released anything from last April, and it was the beta. So I was wondering if is this project active?

Cheers.

Answer

track0 picture track0 · Feb 10, 2016

AntiXss/WPL is now 'end-of-life'. Found this library in a reply elsewhere:

HtmlSanitizer, a .NET library for cleaning HTML fragments from constructs that can lead to XSS attacks.

Project site: https://github.com/mganss/HtmlSanitizer

Related questions

HTML.ActionLink vs Url.Action in ASP.NET Razor

Is there any difference between HTML.ActionLink vs Url.Action or they are just two ways of doing the same thing? When should I prefer one over the other?

Read More
Multiple models in a view

I want to have 2 models in one view. The page contains both LoginViewModel and RegisterViewModel. e.g. public class LoginViewModel { public string Email { get; set; } public string Password { get; set; } } public class RegisterViewModel { public string Name { get; set; } public string …

Read More
Returning a file to View/Download in ASP.NET MVC

I'm encountering a problem sending files stored in a database back to the user in ASP.NET MVC. What I want is a view listing two links, one to view the file and let the mimetype sent to the browser …

Read More