Sanitize URL post-filter

[stevenmoberg]

Could you add a filtering callback event for SanitizedURL so that they could be filtered to prevent against XSRF or SSRF from valid URI attributes, or mark it as virtual so that it can be overwritten and extended in sub classes.

Or should requests like these come from pull requests?

[mganss]

Good idea, I've added both. This might be useful for other use cases as well. The args for the new event FilterUrl contain the original, unfiltered URL and the processed URL (possibly null if it's deemed unsafe). In the event handler you can set the latter to a different value or null if you want it removed.

[stevenmoberg]

wow - thanks for the speedy reply

[smitburde]

@mganss Do you maintain the release notes for the security issues fixed for latest htmlsanitizer?

[mganss]

@smitburde Release notes can be found at https:/mganss/HtmlSanitizer/releases (pretty spartan, I know :)