HtmlSanitizer does not Sanitize certain Text about htmlsanitizer

[mganss]

I can't repro so far. Can you provide an example string that can be used as input to the Sanitize() method?

Using the string above as is yields:

<%25whscheck onmouseover=""alert(1)"">mouseOverThisText""

Same goes for using only one double quote and also within a div.

[jasmeetsangari]

Hi Michael,

Thanks for the Quick Response. This looks like its just html encoded..
I would have hoped the Html the text is completely stripped out.

For example:

 var sanitizer = new HtmlSanitizer();
 sanitizer.AllowedAttributes.Add("class");
 var sanitized = sanitizer.Sanitize(html: @"<whscheck onmouseover=""alert(1)"">mouseOverThisText"" />", outputFormatter: new FormatDefault(DomRenderingOptions.QuoteAllAttributes, HtmlEncoders.Default));

returns back an empty string and that is good. but the text above just returns htmlencoded value no events are fired .. 

[mganss]

That's expected behavior. The parser (correctly) does not recognize the input as containing an element but rather text which it encodes properly. Because there are no elements to strip events won't be fired either. If you still want to filter out all occurrences of <...> in text nodes you can try something like this:

sanitizer.PostProcessNode += (s, e) =>
{
    var t = e.Node as IDomText;
    if (t != null) t.NodeValue = Regex.Replace(t.NodeValue, "<[^>]*>", "");
};

[jasmeetsangari]

OK Thanks...