how just remove some object like Flash an keep all the rest

[giesalabs]

Hello,

thanks for the nice project!
i should like to use it inside my opensource project

is possible to remove only some object (e.g. Flash) and keep all the rest?

Best,
Giancarlo

[mganss]

Sure. You have complete control over which kinds of elements you want to allow/disallow. This can be done through the property AllowedTags where you can configure the names of elements you want to allow (object and embed are disallowed by default). If you need more sophisticated behavior, e.g. allowing some object elements having a certain MIME type while disallowing others, you can use HtmlSanitizer's events. More here: https://github.com/mganss/HtmlSanitizer/wiki/Hooks

[giesalabs]

thanks for the fast reply,

ok, i made some test with:
sanitizer.AllowedTags.Add("html");
sanitizer.AllowedTags.Add("body");
sanitizer.AllowedTags.Add("head");
sanitizer.AllowedTags.Add("link");
sanitizer.AllowedTags.Add("style");

1. but the head in the htmlnot exist anymore in the output string, is my approch wrong?
2. in a simpler way exist a way to allow by defualt all html tags and deny some specific tag?

[mganss]

If you have a complete HTML document (instead of just a body fragment), you need to call SanitizeDocument() instead of Sanitize().

Assuming you want to allow all elements except BLINK:

var sanitizer = new HtmlSanitizer();
sanitizer.RemovingTag += (sender, e) => e.Cancel = e.Tag.NodeName != "BLINK";

Please be aware that this blocklist approach is generally not a good idea if you want to guard against XSS.