mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.55k stars 200 forks source link

Html sanitizer remove the \r tag in the \r\n #395

Closed bjose7 closed 1 year ago

bjose7 commented 2 years ago

When i use this html sanitizer, the input string has \r\n in the request body from stream reader which is added by the dot net when it encodes. But when i pass this to the html serializer, it removes the \r alone and hence it would say its not a match. Is there a way to configure the sanitizer not to remove the \r in the input string

"{\r\n \"name\": \"Some name here\"\r\n}\r\n" is converted to: "{\n \"name\": \"Some name here\"\n}\n"

tiesont commented 1 year ago

This was brought up in a discussion thread a little while ago, here: https://github.com/mganss/HtmlSanitizer/discussions/343

In short, it's not actually HtmlSanitizer that normalizes newlines, but rather AngleSharp, which it does by design: https://github.com/AngleSharp/AngleSharp/issues/719

bjose7 commented 1 year ago

thanks .. understood :)