mganss / HtmlSanitizer

Cleans HTML to avoid XSS attacks
MIT License
1.51k stars 198 forks source link

FilterUrl event not raised for relative URLs if baseUrl is used #542

Closed vanni-giachin closed 2 months ago

vanni-giachin commented 2 months ago

According to the documentation the FilterUrl event should be raised every time a URL is sanitized:

Occurs when a URL is being sanitized

However if the URL to sanitize is relative, and a baseUrl is used as sanitization parameter, the URL filters are not invoked.

See code line: https://github.com/mganss/HtmlSanitizer/blob/v8.0.843/src/HtmlSanitizer/HtmlSanitizer.cs#L856

There is a return statement before OnFilteringUrl is invoked: return new Uri(baseUri, iri.Value).AbsoluteUri;

mganss commented 2 months ago

Great catch, thank you!