HtmlSanitizer
A .NET library for cleaning HTML fragments and documents to prevent XSS attacks using a robust HTML parser.
What is HtmlSanitizer?
HtmlSanitizer is a .NET library that cleans HTML input to prevent cross-site scripting (XSS) attacks by removing dangerous tags, attributes, and CSS. It parses HTML using AngleSharp, ensuring that only safe, whitelisted content remains while protecting against malicious code injection and tag poisoning.
Developers building .NET web applications who need to securely process user-generated HTML content, such as in forums, comment systems, or rich-text editors.
It offers a highly configurable and robust solution for HTML sanitization, with thread-safe operations and fine-grained control over allowed elements, making it a reliable choice for preventing XSS vulnerabilities in .NET environments.
Overview
Cleans HTML to avoid XSS attacks
Use Cases
Best For
- Securing user-generated HTML in .NET web applications
- Preventing XSS attacks in comment sections or forums
- Sanitizing rich-text editor output before storage or display
- Protecting against tag poisoning in HTML fragments
- Configuring custom HTML/CSS allowlists for specific use cases
- Ensuring thread-safe HTML processing in multi-threaded environments
Not Ideal For
- Applications requiring exact HTML input preservation, such as archival systems or precise content editing tools
- High-throughput web services where the performance cost of full HTML parsing is prohibitive
- Non-.NET projects, as the library is specifically designed for .NET ecosystems
- Scenarios where a simpler, regex-based sanitizer suffices for basic filtering without full HTML structure validation
Pros & Cons
Pros
Uses AngleSharp to parse and manipulate HTML, protecting against tag poisoning and invalid HTML that could break layouts, as highlighted in the README for shielding from deliberate or accidental corruption.
Allows fine-grained control over allowed tags, attributes, CSS properties, and URI schemes, with extensive default lists provided, enabling customization for specific security needs.
The Sanitize() and SanitizeDocument() methods are safe for multi-threaded use on a pre-configured instance, facilitating performance in concurrent environments, as stated in the Thread Safety section.
Supports base URI configuration to resolve relative links and control allowed schemes, ensuring safe link management in sanitized content, with examples for adding schemes like 'mailto'.
Cons
As noted in the README, text content is not preserved exactly—special characters are encoded (e.g., '4 < 5' becomes '4 < 5') and HTML structure may change, which can be problematic for applications needing input fidelity.
Despite parsing, the sanitizer might still output invalid HTML fragments, such as incorrect nesting like '<div><li>test</li></div>', as admitted in the README, potentially affecting layout integrity.
The extensive customization options, while powerful, require careful setup and understanding of HTML/CSS standards, which can be daunting for developers unfamiliar with security nuances or those needing quick deployment.
Frequently Asked Questions
Related Projects
Jwt.NetJwt.Net, a JWT (JSON Web Token) implementation for .NET
Security[Archived] Middleware for security and authorization of web apps. Project moved to https://github.com/aspnet/AspNetCore
jose-jwtUltimate Javascript Object Signing and Encryption (JOSE), JSON Web Token (JWT) and Json Web Keys (JWK) Implementation for .NET and .NET Core
SecurityHeadersSmall package to allow adding security headers to ASP.NET Core websites
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.