databinding.WebSecurity.HtmlSanitizer.AspNetCore 2025.2.18.1

databinding.WebSecurity.HtmlSanitizer.AspNetCore

This library provides ActionFilter for MVC and API controller to detect and remove malicious inputs with databinding.WebSecurity.HtmlSanitizer.

For fields such as passwords, the check can be deactivated with the [SanitizerDisabled] attribute. This guarantees that passwords are not converted, especially special characters such as &, < and >.

Getting started

Prerequisites

• .NET 8 or later
• Visual Studio 2022/Code or later

Installation

To install the library, you can use the NuGet package manager:

dotnet add package databinding.WebSecurity.HtmlSanitizer.AspNetCore

Usage

The package provides the ActionFilter HtmlSanitizerCheckActionFilter and HtmlSanitizerCheckAsyncActionFilter.

Here's a basic example of how to use it:

    [HtmlSanitizerCheckActionFilter]
    public class HomeController : Controller
    {
     ...
    }

The filter can be configured globally for all controllers in Startup.cs or Program.cs.

    var builder = WebApplication.CreateBuilder(args);

    builder.Services.AddControllersWithViews(
        o => o.Filters.Add<HtmlSanitizerCheckActionFilter>());

The HtmlSanitizerRichtextDefauls class is available for additional configurations. This enables additional settings for AllowedAtRules, AllowedSchemes, AllowedTags, AllowedAttributes, AllowedCssProperties, UriAttributes and AllowedClasses via static properties.

Configurable via Program.cs or Startup.cs.

    HtmlSanitizerRichtextDefauls.AllowedTags.Add("img");
    var builder = WebApplication.CreateBuilder(args);

    builder.Services.AddControllersWithViews(
        o => o.Filters.Add<HtmlSanitizerCheckActionFilter>());

To avoid unwanted side effects for special cases such as passwords, the logic can be deactivated with the DisableSanitizer attribute on a property.

    public class LoginModel
    {
       ...

       [SanitizerDisabled]
       public string Password { get; set; }
    }