HtmlSanitizer by Michael Ganss

<PackageReference Include="HtmlSanitizer" Version="6.0.430-beta" />

.NET API 44,032 bytes

 HtmlSanitizer

public class HtmlSanitizer : IHtmlSanitizer
Cleans HTML documents and fragments from constructs that can lead to XSS attacks.
public static readonly Regex DefaultDisallowedCssPropertyValue

The default regex for disallowed CSS property values.

public static ISet<CssRuleType> DefaultAllowedAtRules { get; }

The default allowed CSS at-rules.

public static ISet<string> DefaultAllowedAttributes { get; }

The default allowed HTML attributes.

public static ISet<string> DefaultAllowedClasses { get; }

The default allowed CSS classes.

public static ISet<string> DefaultAllowedCssProperties { get; }

The default allowed CSS properties.

public static ISet<string> DefaultAllowedSchemes { get; }

The default allowed URI schemes.

public static ISet<string> DefaultAllowedTags { get; }

The default allowed HTML tag names.

public static Func<HtmlParser> DefaultHtmlParserFactory { get; set; }

Gets or sets the default Func<T> object that creates the parser used for parsing the input.

public static bool DefaultKeepChildNodes { get; set; }

Gets or sets the default value indicating whether to keep child nodes of elements that are removed. Default is false.

public static IMarkupFormatter DefaultOutputFormatter { get; set; }

Gets or sets the default IMarkupFormatter object used for generating output. Default is Instance.

public static ISet<string> DefaultUriAttributes { get; }

The default URI attributes.

public bool AllowDataAttributes { get; set; }

Allow all HTML5 data attributes; the attributes prefixed with data-

public ISet<CssRuleType> AllowedAtRules { get; }

Gets or sets the allowed CSS at-rules such as "@media" and "@font-face".

public ISet<string> AllowedAttributes { get; }

Gets or sets the allowed HTML attributes such as "href" and "alt".

public ISet<string> AllowedClasses { get; }

Gets or sets the allowed CSS classes. If the set is empty, all classes will be allowed.

public ISet<string> AllowedCssProperties { get; }

Gets or sets the allowed CSS properties such as "font" and "margin".

public ISet<string> AllowedSchemes { get; }

Gets or sets the allowed HTTP schemes such as "http" and "https".

public ISet<string> AllowedTags { get; }

Gets or sets the allowed HTML tag names such as "a" and "div".

public Regex DisallowCssPropertyValue { get; set; }

Gets or sets a regex that must not match for legal CSS property values.

public Func<HtmlParser> HtmlParserFactory { get; set; }

Gets or sets the Func<T> object the creates the parser used for parsing the input.

public bool KeepChildNodes { get; set; }

Gets or sets a value indicating whether to keep child nodes of elements that are removed. Default is DefaultKeepChildNodes.

public IMarkupFormatter OutputFormatter { get; set; }

Gets or sets the IMarkupFormatter object used for generating output. Default is DefaultOutputFormatter.

public ISet<string> UriAttributes { get; }

Gets or sets the HTML attributes that can contain a URI such as "href".

public event EventHandler<FilterUrlEventArgs> FilterUrl

Occurs when a URL is being sanitized.

public event EventHandler<PostProcessDomEventArgs> PostProcessDom

Occurs after sanitizing the document and post processing nodes.

public event EventHandler<PostProcessNodeEventArgs> PostProcessNode

Occurs for every node after sanitizing.

public event EventHandler<RemovingAtRuleEventArgs> RemovingAtRule

Occurs before an at-rule is removed.

public event EventHandler<RemovingAttributeEventArgs> RemovingAttribute

Occurs before an attribute is removed.

public event EventHandler<RemovingCommentEventArgs> RemovingComment

Occurs before a comment is removed.

public event EventHandler<RemovingCssClassEventArgs> RemovingCssClass

Occurs before a CSS class is removed.

public event EventHandler<RemovingStyleEventArgs> RemovingStyle

Occurs before a style is removed.

public event EventHandler<RemovingTagEventArgs> RemovingTag

Occurs before a tag is removed.

public HtmlSanitizer(IEnumerable<string> allowedTags = null, IEnumerable<string> allowedSchemes = null, IEnumerable<string> allowedAttributes = null, IEnumerable<string> uriAttributes = null, IEnumerable<string> allowedCssProperties = null)

Initializes a new instance of the HtmlSanitizer class.

protected static string DecodeCss(string css)

Decodes CSS unicode escapes and removes comments.

protected Iri GetSafeIri(string url)

Tries to create a safe Iri object from a string.

protected virtual void OnFilteringUrl(FilterUrlEventArgs e)

Raises the RemovingUrl event.

protected virtual void OnPostProcessDom(PostProcessDomEventArgs e)

Raises the PostProcessDom event.

protected virtual void OnPostProcessNode(PostProcessNodeEventArgs e)

Raises the PostProcessNode event.

protected virtual void OnRemovingAtRule(RemovingAtRuleEventArgs e)

Raises the RemovingAtRule event.

protected virtual void OnRemovingAttribute(RemovingAttributeEventArgs e)

Raises the RemovingAttribute event.

protected virtual void OnRemovingComment(RemovingCommentEventArgs e)

Raises the RemovingComment event.

protected virtual void OnRemovingCssClass(RemovingCssClassEventArgs e)

Raises the RemovingCSSClass event.

protected virtual void OnRemovingStyle(RemovingStyleEventArgs e)

Raises the RemovingStyle event.

protected virtual void OnRemovingTag(RemovingTagEventArgs e)

Raises the RemovingTag event.

public string Sanitize(string html, string baseUrl = "", IMarkupFormatter outputFormatter = null)

Sanitizes the specified HTML body fragment. If a document is given, only the body part will be returned.

public string SanitizeDocument(string html, string baseUrl = "", IMarkupFormatter outputFormatter = null)

Sanitizes the specified HTML document. Even if only a fragment is given, a whole document will be returned.

public string SanitizeDocument(Stream html, string baseUrl = "", IMarkupFormatter outputFormatter = null)

Sanitizes the specified HTML document. Even if only a fragment is given, a whole document will be returned.

public IHtmlDocument SanitizeDom(string html, string baseUrl = "")

Sanitizes the specified HTML body fragment. If a document is given, only the body part will be returned.

public IHtmlDocument SanitizeDom(IHtmlDocument document, IHtmlElement context = null, string baseUrl = "")

Sanitizes the specified parsed HTML body fragment. If the document has not been parsed with CSS support then all styles will be removed.

protected void SanitizeStyle(IElement element, string baseUrl)

Sanitizes the style.

protected virtual string SanitizeUrl(IElement element, string url, string baseUrl)

Sanitizes a URL.