How to safely output custom html in asp mvc?

Question

HTML

There is a project where users enter html using wysiwyg , then this html needs to be displayed to users. How to properly clean html from xss, iframe flash, javascript and not closed tags?

Answer 1

With such a statement of the problem, it is more important for you to control the INPUT of data, and not the OUTPUT. The ASP.NET libraries, as far as I know, do not have methods like .RemovePotentialIssuesFromHtml() - define accordingly what the user can enter and what he cannot. Delete them when saving, or notify the client that he has introduced potentially dangerous constructs.

Answer 2

You can use the HtmlSanitizer library
https://github.com/mganss/HtmlSanitizer
It will help you remove unsafe HTML tags.
If you do not want to delete the tags entered by users, then set the AllowHtmlAttribute attribute for the field

public class BlogEntry {
    public int UserId {get;set;}
    [AllowHtml] 
    public string BlogText {get;set;}
 }

And when outputting to the form, encode the value, for example, using AntiXssEncoder
https://msdn.microsoft.com/ru-ru/library/system.we...
www.codeguru.com/csharp/.net/net_asp/preventing-cr. ..Or
code with JS
weblogs.asp.net/jongalloway/preventing-javascript-...