I want to include the ability for users of my ASP.NET Core website to submit formatted text, which I will save and later display to some users. After some investigation and discussion, it has become clear to me that I'm stuck with accepting HTML markup as the formatted text representation. (In the referenced discussion, I proposed using markdown as a "safe" representation of simple, formatted text. However, markdown can be tricked into emitting active (JavaScript) content using techniques similar to XSS attacks.)

So, if I am stuck with accepting and later emitting - verbatim - HTML, then I need some way to "clean" the HTML to remove active content.

Is there a reliable HTML cleaner that I can include in server? Presumably, the JavaScript engine in any website knows how to find and execute even "sneaky" JavaScript. Is there an HTML cleaner that incorporates similar technology so that it can reasonably guarantee that all of the JavaScript that would have been "found" by a browser has been found?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.