[英]Remove all Inline Javascript in C#
I have a string: `<p onclick="alert('abc')" style="color: black">text</p>`
我有一个字符串:
`<p onclick="alert('abc')" style="color: black">text</p>`
I want to remove all Javascript like onclick, onchange, ...
leaving only HTML and CSS.我想删除所有的 Javascript,比如
onclick, onchange, ...
只留下 HTML 和 CSS。 is there any way to do this in C#?有没有办法在 C# 中做到这一点? the only way I can think of is to remove each javascript tag from the string.
我能想到的唯一方法是从字符串中删除每个 javascript 标记。
Input: <p onclick="alert('abc')" style="color: black">text</p>
输入:
<p onclick="alert('abc')" style="color: black">text</p>
Output: <p style="color: black ">text</p>
输出:
<p style="color: black ">text</p>
You can use HtmlSanitizer to remove the inline java script for provided HTML fragment.您可以使用HtmlSanitizer删除提供的 HTML 片段的内联 java 脚本。
For ex - the following code例如 - 以下代码
var sanitizer = new HtmlSanitizer();
var html = @"<script>alert('xss')</script><div onload=""alert('xss')"""
+ @"style=""background-color: test"">Test<img src=""test.gif"""
+ @"style=""background-image: url(javascript:alert('xss')); margin: 10px""><p onclick =""alert('abc')"" style =""color: black"">text</p></div>";
var sanitized = sanitizer.Sanitize(html);
returns the output as将输出返回为
<div>Test<img src="test.gif" style="margin: 10px"><p style="color: rgba(0, 0, 0, 1)">text</p></div>
You can check this fiddle for more details.您可以查看此小提琴以获取更多详细信息。
The best way is to use Html Agility Pack .最好的方法是使用Html Agility Pack 。 I have linked tha page you need in its documentations.
我已经在其文档中链接了您需要的页面。
Use it like this:像这样使用它:
var htmlDoc = new HtmlDocument();
htmlDoc.LoadHtml(html);
var pNode = htmlDoc.DocumentNode.SelectSingleNode("//p");
pNode.Attributes.Remove("onclick");
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.