diff --git a/Web.HtmlSanitizer.Tests/AttributeCheckTests.cs b/Web.HtmlSanitizer.Tests/AttributeCheckTests.cs
index b540a90..1b55a08 100644
--- a/Web.HtmlSanitizer.Tests/AttributeCheckTests.cs
+++ b/Web.HtmlSanitizer.Tests/AttributeCheckTests.cs
@@ -51,7 +51,9 @@ public void AHrefUrlCheckRelativeTest()
}
-
+ ///
+ /// Verifies the functioning of the URL check on src attributes.
+ ///
[Fact]
public void ImgSrcUrlCheckTest()
{
@@ -67,7 +69,7 @@ public void ImgSrcUrlCheckTest()
Assert.Equal(expectedIllegal, result);
// Test a legal well formed url
- var inputLegal = @">";
+ var inputLegal = @"";
result = sanitizer.Sanitize(inputLegal);
Assert.Equal(inputLegal, result);
}
diff --git a/Web.HtmlSanitizer/HtmlSanitizer.cs b/Web.HtmlSanitizer/HtmlSanitizer.cs
index 259bfc8..1811e0a 100644
--- a/Web.HtmlSanitizer/HtmlSanitizer.cs
+++ b/Web.HtmlSanitizer/HtmlSanitizer.cs
@@ -59,7 +59,7 @@ public HtmlSanitizer()
private void RegisterChecks()
{
- AttributeCheckRegistry.Add(HtmlSanitizerCheckType.Url, new HtmlSanitizerAttributeCheckHandler(LinkHrefCheck));
+ AttributeCheckRegistry.Add(HtmlSanitizerCheckType.Url, new HtmlSanitizerAttributeCheckHandler(UrlCheckHandler));
AttributeCheckRegistry.Add(HtmlSanitizerCheckType.AllowAttribute, new HtmlSanitizerAttributeCheckHandler(x => SanitizerOperation.DoNothing));
}
@@ -100,13 +100,14 @@ public static bool AttributeUrlCheck(HtmlAttribute attribute)
}
///
- /// Checks if the href attribute contains a valid link.
+ /// Checks if the attribute contains a valid link.
///
///
///
- public static SanitizerOperation LinkHrefCheck(HtmlAttribute attribute)
+ public static SanitizerOperation UrlCheckHandler(HtmlAttribute attribute)
{
- // Check the url. There's no use in keeping link tags without a link, so flatten the tag on failure.
+
+ // Check the url. We assume that there's no use in keeping for example a link tag without a href, so flatten the tag on failure.
if (!AttributeUrlCheck(attribute))
return SanitizerOperation.FlattenTag;
diff --git a/Web.HtmlSanitizer/Properties/AssemblyInfo.cs b/Web.HtmlSanitizer/Properties/AssemblyInfo.cs
index 0867b8b..01053d9 100644
--- a/Web.HtmlSanitizer/Properties/AssemblyInfo.cs
+++ b/Web.HtmlSanitizer/Properties/AssemblyInfo.cs
@@ -32,5 +32,5 @@
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.1.3.0")]
-[assembly: AssemblyFileVersion("1.1.3.0")]
+[assembly: AssemblyVersion("1.1.4.0")]
+[assembly: AssemblyFileVersion("1.1.4.0")]
diff --git a/Web.HtmlSanitizer/Web.HtmlSanitizer.nuspec b/Web.HtmlSanitizer/Web.HtmlSanitizer.nuspec
index 6a7038b..9be89b1 100644
--- a/Web.HtmlSanitizer/Web.HtmlSanitizer.nuspec
+++ b/Web.HtmlSanitizer/Web.HtmlSanitizer.nuspec
@@ -2,7 +2,7 @@
Vereyon.Web.HtmlSanitizer
- 1.1.3.0
+ 1.1.4.0
HtmlRuleSanitizer
Vereyon
Vereyon
@@ -10,7 +10,7 @@
https://github.com/Vereyon/HtmlRuleSanitizer
false
Rule based HTML sanitizer using a white list. Documentation at: https://github.com/Vereyon/HtmlRuleSanitizer
- Fixed relative urls not passing check.
+ Fixed unclosed tags not being handled correctly. Added url checks for src attributes.
Copyright 2016
ASP.NET MVC HTML sanitizer XSS antixss anti security