Skip to Content (Press Enter)
2017-06-19 06-39-23
Valerij Gerasimov
43Views
4Comments
What is configuration for HtmlSanitizer NuGet package of Sanitizer Forge component?
Question
Security
ODC

HtmlSanitizer is a .NET library is used by Forge component for cleaning HTML. 

In order to facilitate different use cases, HtmlSanitizer can be customized at several levels:

  • Configure allowed HTML tags through the property AllowedTags. All other tags will be stripped.
  • Configure allowed HTML attributes through the property AllowedAttributes. All other attributes will be stripped.
  • Configure allowed CSS property names through the property AllowedCssProperties. All other styles will be stripped.
  • Configure allowed CSS at-rules through the property AllowedAtRules. All other at-rules will be stripped.
  • Configure allowed URI schemes through the property AllowedSchemes. All other URIs will be stripped.
  • Configure HTML attributes that contain URIs (such as "src", "href" etc.) through the property UriAttributes.
  • Provide a base URI that will be used to resolve relative URIs against.
  • Cancelable events are raised before a tag, attribute, or style is removed.

So what configuration is used by Forge component? Is it empty one (default settings are used) or some customization is done (if so what are details)?

0
0
27 Sep 2023
Copy Link
2024-07-05 14-16-55
Daniël Kuhlmann
 
MVP

Hi Valerij,

You are not explicitly mentioned which Forge component you talk about, the only HTML Sanitizer component in the Forge I could find is https://www.outsystems.com/forge/component-overview/8079/reactive-html-sanitizer which I build, and it doesn't use a .NET library.

The build in extension Sanitization, has SanitizeHTML action, that sanitizes the provided HTML using the OWASP Java HTML Sanitizer Project. The implemented policy follows the example in https://github.com/OWASP/java-html-sanitizer/blob/master/src/main/java/org/owasp/html/examples/EbayPolicyExample.java. 

Regards,

Daniel

0
0
29 Sep 2023
Copy Link
2017-06-19 06-39-23
Valerij Gerasimov

Hi Daniel, 

Thank you for your answer. Sorry for missing reference to Forge component. 

Actually our project code uses another one https://www.outsystems.com/forge/component-overview/15957/sanitization.

Best regards,
Valery

0
0
29 Sep 2023
Copy Link
2024-07-05 14-16-55
Daniël Kuhlmann
 
MVP

When you post a question you can also select the platform ODC or O11, that would make the process for people to help more efficiently. I updated your original post to reflect that your question is regarding ODC.

0
0
29 Sep 2023
Copy Link
2024-07-05 14-16-55
Daniël Kuhlmann
 
MVP

Replying to You's comment on 29 Sep 2023 08:54:05

I forwarded your question internally to OutSystems, as I don't think the community will be able to answer it.

0
0
29 Sep 2023
Copy Link
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.