如何清理ASP.NET中的MCE輸入？

Question

C＃中是否有一個實用程序/函數來清理tinyMCE富文本的源代碼。我想刪除危險標籤，但希望將安全的html標籤列入白名單。

Answer 1

我不認爲您可以使用C＃的內置消毒劑，但這是我在做同樣事情時所做的。我使用了AjaxControlToolkit附帶的HtmlAgilityPackSanitizerProvider。代碼看起來像這樣：

private static AjaxControlToolkit.Sanitizer.HtmlAgilityPackSanitizerProvider sanitizer = new AjaxControlToolkit.Sanitizer.HtmlAgilityPackSanitizerProvider(); 

private static Dictionary<string, string[]> elementWhitelist = new Dictionary<string, string[]> 
{ 
    {"b"   , new string[] { "style" }}, 
    {"strong"  , new string[] { "style" }}, 
    {"i"   , new string[] { "style" }}, 
    {"em"   , new string[] { "style" }}, 
    {"u"   , new string[] { "style" }}, 
    {"strike"  , new string[] { "style" }}, 
    {"sub"   , new string[] { "style" }}, 
    {"sup"   , new string[] { "style" }}, 
    {"p"   , new string[] { "align" }}, 
    {"div"   , new string[] { "style", "align" }}, 
    {"ol"   , new string[] { }}, 
    {"li"   , new string[] { }}, 
    {"ul"   , new string[] { }}, 
    {"a"   , new string[] { "href" }}, 
    {"font"   , new string[] { "style", "face", "size", "color" }}, 
    {"span"   , new string[] { "style" }}, 
    {"blockquote" , new string[] { "style", "dir" }}, 
    {"hr"   , new string[] { "size", "width", "id" }}, 
    {"img"   , new string[] { "src" }}, 
    {"h1"   , new string[] { "style" }}, 
    {"h2"   , new string[] { "style" }}, 
    {"h3"   , new string[] { "style" }}, 
    {"h4"   , new string[] { "style" }}, 
    {"h5"   , new string[] { "style" }}, 
    {"h6"   , new string[] { "style" }} 
}; 

private static Dictionary<string, string[]> attributeWhitelist = new Dictionary<string, string[]> 
{ 
    {"style" , new string[] {}}, 
    {"align" , new string[] {}}, 
    {"href"  , new string[] {}}, 
    {"face"  , new string[] {}}, 
    {"size"  , new string[] {}}, 
    {"color" , new string[] {}}, 
    {"dir"  , new string[] {}}, 
    {"width" , new string[] {}}, 
    {"id"  , new string[] {}}, 
    {"src"  , new string[] {}} 
}; 

public string SanitizeHtmlInput(string unsafeStr) 
{ 
    return sanitizer.GetSafeHtmlFragment(unsafeStr, elementWhitelist, attributeWhitelist); 
} 

希望這有助於。

Answer 2

清理Html文檔涉及很多棘手的事情。這個包可能有幫助： https://github.com/mganss/HtmlSanitizer 我用它來做我自己的項目。