HtmlSanitizer Class

Namespace: Meziantou.Framework.Sanitizers
Assembly: Meziantou.Framework.HtmlSanitizer.dll
Package: Meziantou.Framework.HtmlSanitizer 3.1.13
Source: HtmlSanitizer.cs
Available in package assets: net10.0net11.0

Sanitizes HTML fragments to prevent XSS attacks by removing dangerous elements, attributes, and URLs while preserving safe HTML structure.

public sealed class HtmlSanitizer

Example

Basic HTML sanitization:

var sanitizer = new HtmlSanitizer();
var safeHtml = sanitizer.SanitizeHtmlFragment("<p>Hello <script>alert('xss')</script>World</p>");
Assert.Equal("<p>Hello World</p>", safeHtml);

Constructors

Name	Description
HtmlSanitizer()

HtmlSanitizer()

HtmlSanitizer.cs

public HtmlSanitizer()

No documentation is available.

Properties

Name	Description
AllowComments	Gets or sets a value indicating whether HTML comments are kept in the sanitized output. Comments are removed by default because downlevel-hidden conditional comments (`<!--[if IE]><script>…</script><![endif]-->`) are executed by legacy browsers.
BlockedElements	Gets the set of HTML elements that will be completely removed from the output, including their content. By default includes script and style elements.
SrcsetAttributes	Gets the set of attribute names that contain srcset values (responsive image sources) and should be validated for safety.
UriAttributes	Gets the set of attribute names that contain URLs and should be validated for safety. Unsafe URLs will be replaced with empty strings.
ValidAttributePrefixes	Gets the set of prefixes of the HTML attributes that are allowed in sanitized output, in addition to the attributes of `HtmlSanitizer.ValidAttributes`. By default, it contains `aria-`.
ValidAttributes	Gets the set of HTML attributes that are allowed in sanitized output. Attributes not in this set will be removed from elements.
ValidElements	Gets the set of HTML elements that are allowed in sanitized output. Elements not in this set are unwrapped: the tag is dropped but its content is kept, unless the element is in the BlockedElements set.

AllowComments

HtmlSanitizer.cs

Gets or sets a value indicating whether HTML comments are kept in the sanitized output. Comments are removed by default because downlevel-hidden conditional comments () are executed by legacy browsers.

public bool AllowComments { get; set; }

Property value

bool

BlockedElements

HtmlSanitizer.cs

Gets the set of HTML elements that will be completely removed from the output, including their content. By default includes script and style elements.

public ISet<string> BlockedElements { get; }

Property value

ISet<string>

SrcsetAttributes

HtmlSanitizer.cs

Gets the set of attribute names that contain srcset values (responsive image sources) and should be validated for safety.

public ISet<string> SrcsetAttributes { get; }

Property value

ISet<string>

UriAttributes

HtmlSanitizer.cs

Gets the set of attribute names that contain URLs and should be validated for safety. Unsafe URLs will be replaced with empty strings.

public ISet<string> UriAttributes { get; }

Property value

ISet<string>

ValidAttributePrefixes

HtmlSanitizer.cs

Gets the set of prefixes of the HTML attributes that are allowed in sanitized output, in addition to the attributes of HtmlSanitizer.ValidAttributes. By default, it contains aria-.

public ISet<string> ValidAttributePrefixes { get; }

Property value

ISet<string>

ValidAttributes

HtmlSanitizer.cs

Gets the set of HTML attributes that are allowed in sanitized output. Attributes not in this set will be removed from elements.

public ISet<string> ValidAttributes { get; }

Property value

ISet<string>

ValidElements

HtmlSanitizer.cs

Gets the set of HTML elements that are allowed in sanitized output. Elements not in this set are unwrapped: the tag is dropped but its content is kept, unless the element is in the BlockedElements set.

public ISet<string> ValidElements { get; }

Property value

ISet<string>

Methods

Name	Description
SanitizeHtmlFragment(string?)	Sanitizes an HTML fragment by removing dangerous elements, attributes, and URLs while preserving safe HTML structure.

SanitizeHtmlFragment(string?)

HtmlSanitizer.cs

Sanitizes an HTML fragment by removing dangerous elements, attributes, and URLs while preserving safe HTML structure.

public string? SanitizeHtmlFragment(string? html)

Parameters

html string?: The HTML fragment to sanitize.

Returns

string? A sanitized HTML fragment safe for rendering.