Allow only data:image mime type as allowed scheme for data

mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks

MIT License

1.55k stars 200 forks source link

Allow only data:image mime type as allowed scheme for data #230

Closed Dev-questions closed 4 years ago

Dev-questions commented 4 years ago

var sanitizer = new HtmlSanitizer(); sanitizer.AllowedSchemes.Add("data");

Above is allowing all data URIs, where i need to allow only data:image URI. I don't want to allow other once like dat:text/html etc. Is it possible to allow only data:image?

mganss commented 4 years ago

Yes, see https://github.com/mganss/HtmlSanitizer/issues/122#issuecomment-316666388 and examples at https://github.com/mganss/HtmlSanitizer/wiki/Hooks