I'm looking for a good HTML sanitizer to use in an ASP.NET project. The catch is that the sanitizer must support style attributes, which may contain CSS properties, which must also be sanitized. So far I haven't been able to find a good product to use. Before I bite the bullet and write my own sanitizer, I thought I might try to see what people here are using first.
Libraries that I've looked at and rejected:
- AntiXSS Library (old version is insecure, new version strips style tags)
- AntiSamy .NET (unmaintained, lacks necessary features in the .NET version, has obsolete dependencies)
- The HTMLAgilityPackSanitizer in AjaxControlToolkit (escapes style tags)
The ideal would be to have a whitelist-based sanitizer that also validates property values against a list of known values or regexes.
Anybody able to point me in the right direction?