mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.55k stars 200 forks source link

Some property values are removed when sanitized(Double quotation mark) #360

Closed wtujvk closed 2 years ago

wtujvk commented 2 years ago

I have explored and have some open items that show wrong results (valid values are removed). Here is a short point-wise summary:

"<p style=\"margin-bottom: 25px; padding: 0; color: rgba(51, 51, 51, 1); line-height: 2; font-family: \"Microsoft YaHei\", arial, helvetica, sans-serif; white-space: text-align: right\">xxxx内容</p>

sanitized to

"<p style=\"margin-bottom: 25px; padding: 0; color: rgba(51, 51, 51, 1); line-height: 2\">xxxx内容</p>

I use like this: instance.RemovingAttribute += Instance_RemovingAttribute; private static void Instance_RemovingAttribute(object sender, RemovingAttributeEventArgs e) { if (e.Tag.TagName.Equals("img", StringComparison.CurrentCultureIgnoreCase) && e.Attribute.Name.Equals("src", StringComparison.CurrentCultureIgnoreCase)) { if (e.Attribute.Value.StartsWith("data:image/png;base64,")) { e.Cancel = true; } } }

Removed after property 'font-family'. At Method 'Instance_RemovingAttribute' ,I get 'e.Attribute.Name' is 'microsoft '、‘yahei’ as so on How can I use it correctly ?

mganss commented 2 years ago

The double quotes around "Microsoft YaHei" end the style attribute. Use single quotes or &quot; instead.

<p style="margin-bottom: 25px; padding: 0; color: rgba(51, 51, 51, 1); line-height: 2; font-family: 'Microsoft YaHei', arial, helvetica, sans-serif; white-space: text-align: right">xxxx内容</p>