search

mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.52k stars 198 forks source link

Redirect to another mobile app link is getting removed by Ganss XSS HtmlFormatter. #471

Closed iaashu98 closed 9 months ago

iaashu98 commented 9 months ago

Whenever I tried to put a link which do not start with http or https, it's getting removed by sanitizer. For example, I was trying to use a link which was supposed to redirect me to another application for further process. But, after getting through the Ganss sanitizer it is losing the whole href tag. This was the link <a href="rallypointapp://callback" rel="noopener">Rally Point</a> and it was getting changed to <a rel="noopener">Rally Point</a> which is not even a link. Please have a look. Thank you!

mganss commented 9 months ago

This is by design. If you want to allow links with the rallypointapp scheme, add it to the AllowedSchemes collection.

tiesont commented 9 months ago

@iaashu98 As @mganss notes, you need to update the AllowedSchemes, as shown here, https://github.com/mganss/HtmlSanitizer/wiki/Options#allowed-uri-schemes, and on the Examples wiki: https://github.com/mganss/HtmlSanitizer/wiki/Examples

iaashu98 commented 9 months ago

@mganss Amazing, thank you for the heads up. Appreciated! @tiesont Great, the links were really helpful. Thank you so much for this.