SVG Santization

Shyam 1 Reputation point
2020-12-11T17:17:12.247+00:00

Is there any way to sanitize SVG from XSS using C#. Any library/ support available?

ASP.NET
ASP.NET
A set of technologies in the .NET Framework for building web applications and XML web services.
3,254 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Sean Fang-MSFT 156 Reputation points
    2020-12-14T09:09:38.42+00:00

    Hi @Shyam ,

    You could try this .NET library:
    HtmlSanitizer

    It is a .NET library for cleaning HTML fragments and documents from constructs that can lead to XSS attacks. It uses AngleSharp to parse, manipulate, and render HTML and CSS.

    As you can see, tags allowed by default do not contain SVG:

    a, abbr, acronym, address, area, article, aside, b, bdi, big, blockquote, br, button, caption, center, cite, code, col, colgroup, data, datalist, dd, del, details, dfn, dir, div, dl, dt, em, fieldset, figcaption, figure, font, footer, form, h1, h2, h3, h4, h5, h6, header, hr, i, img, input, ins, kbd, keygen, label, legend, li, main, map, mark, menu, menuitem, meter, nav, ol, optgroup, option, output, p, pre, progress, q, rp, rt, ruby, s, samp, section, select, small, span, strike, strong, sub, summary, sup, table, tbody, td, textarea, tfoot, th, thead, time, tr, tt, u, ul, var, wbr

    There is an online demo that you could check if it is what you want.
    xss.ganss.org

    Best regards,
    Sean

    If the answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    0 comments