A .NET library for cleaning HTML fragments and documents to prevent XSS attacks using a robust HTML parser.
HtmlSanitizer is a .NET library that cleans HTML input to prevent cross-site scripting (XSS) attacks by removing dangerous tags, attributes, and CSS. It parses HTML using AngleSharp, ensuring that only safe, whitelisted content remains while protecting against malicious code injection and tag poisoning.
Developers building .NET web applications who need to securely process user-generated HTML content, such as in forums, comment systems, or rich-text editors.
It offers a highly configurable and robust solution for HTML sanitization, with thread-safe operations and fine-grained control over allowed elements, making it a reliable choice for preventing XSS vulnerabilities in .NET environments.
Cleans HTML to avoid XSS attacks
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Uses AngleSharp to parse and manipulate HTML, protecting against tag poisoning and invalid HTML that could break layouts, as highlighted in the README for shielding from deliberate or accidental corruption.
Allows fine-grained control over allowed tags, attributes, CSS properties, and URI schemes, with extensive default lists provided, enabling customization for specific security needs.
The Sanitize() and SanitizeDocument() methods are safe for multi-threaded use on a pre-configured instance, facilitating performance in concurrent environments, as stated in the Thread Safety section.
Supports base URI configuration to resolve relative links and control allowed schemes, ensuring safe link management in sanitized content, with examples for adding schemes like 'mailto'.
As noted in the README, text content is not preserved exactly—special characters are encoded (e.g., '4 < 5' becomes '4 < 5') and HTML structure may change, which can be problematic for applications needing input fidelity.
Despite parsing, the sanitizer might still output invalid HTML fragments, such as incorrect nesting like '<div><li>test</li></div>', as admitted in the README, potentially affecting layout integrity.
The extensive customization options, while powerful, require careful setup and understanding of HTML/CSS standards, which can be daunting for developers unfamiliar with security nuances or those needing quick deployment.