|
1 | 1 | HtmlSanitizer
|
2 | 2 | =============
|
3 | 3 |
|
4 |
| -[](http://badge.fury.io/nu/HtmlSanitizer) |
| 4 | +[](https://badge.fury.io/nu/HtmlSanitizer) |
5 | 5 | [](https://ci.appveyor.com/project/mganss/htmlsanitizer/branch/master)
|
6 | 6 | [](https://codecov.io/github/mganss/HtmlSanitizer?branch=master)
|
7 | 7 | [](https://sonarcloud.io/dashboard?id=mganss_HtmlSanitizer)
|
@@ -34,14 +34,14 @@ Install the [HtmlSanitizer NuGet package](https://www.nuget.org/packages/HtmlSan
|
34 | 34 | ```C#
|
35 | 35 | var sanitizer = new HtmlSanitizer();
|
36 | 36 | var html = @"<script>alert('xss')</script><div onload=""alert('xss')"""
|
37 |
| - + @"style=""background-color: test"">Test<img src=""test.gif""" |
| 37 | + + @"style=""background-color: test"">Test<img src=""test.png""" |
38 | 38 | + @"style=""background-image: url(javascript:alert('xss')); margin: 10px""></div>";
|
39 |
| -var sanitized = sanitizer.Sanitize(html, "http://www.example.com"); |
| 39 | +var sanitized = sanitizer.Sanitize(html, "https://www.example.com"); |
40 | 40 | Assert.That(sanitized, Is.EqualTo(@"<div style=""background-color: test"">"
|
41 |
| - + @"Test<img style=""margin: 10px"" src=""http://www.example.com/test.gif""></div>")); |
| 41 | + + @"Test<img style=""margin: 10px"" src=""https://www.example.com/test.png""></div>")); |
42 | 42 | ```
|
43 | 43 |
|
44 |
| -There's an [online demo](http://xss.ganss.org/), plus there's also a [.NET Fiddle](https://dotnetfiddle.net/892nOk) you can play with. |
| 44 | +There's an [online demo](https://xss.ganss.org/), plus there's also a [.NET Fiddle](https://dotnetfiddle.net/892nOk) you can play with. |
45 | 45 |
|
46 | 46 | More example code and a description of possible options can be found in the [Wiki](https://github.com/mganss/HtmlSanitizer/wiki).
|
47 | 47 |
|
@@ -73,7 +73,7 @@ _Note:_ the `style` tag is disallowed by default.
|
73 | 73 | ### URI schemes allowed by default
|
74 | 74 | ``http, https``
|
75 | 75 |
|
76 |
| -_Note:_ [Protocol-relative URLs](http://en.wikipedia.org/wiki/Wikipedia:Protocol-relative_URL) (e.g. <a href="//github.com">//github.com</a>) are allowed by default (as are other relative URLs). |
| 76 | +_Note:_ [Protocol-relative URLs](https://en.wikipedia.org/wiki/Wikipedia:Protocol-relative_URL) (e.g. <a href="//github.com">//github.com</a>) are allowed by default (as are other relative URLs). |
77 | 77 |
|
78 | 78 | to allow `mailto:` links:
|
79 | 79 |
|
@@ -105,4 +105,4 @@ On the other hand, although some broken HTML is fixed by the parser, the output
|
105 | 105 | License
|
106 | 106 | -------
|
107 | 107 |
|
108 |
| -[MIT X11](http://en.wikipedia.org/wiki/MIT_License) |
| 108 | +[MIT X11](https://en.wikipedia.org/wiki/MIT_License) |
0 commit comments