diff --git a/src/HtmlSanitizer/HtmlSanitizer.cs b/src/HtmlSanitizer/HtmlSanitizer.cs
index 732a032..b7ac78d 100644
--- a/src/HtmlSanitizer/HtmlSanitizer.cs
+++ b/src/HtmlSanitizer/HtmlSanitizer.cs
@@ -99,6 +99,11 @@ public HtmlSanitizer(HtmlSanitizerOptions options)
AllowedAtRules = new HashSet(options.AllowedAtRules);
}
+ ///
+ /// Gets or sets the default method that encodes literal text content.
+ ///
+ public Action EncodeLiteralTextElementContent { get; set; } = DefaultEncodeLiteralTextElementContent;
+
///
/// Gets or sets the default value indicating whether to keep child nodes of elements that are removed. Default is false.
///
@@ -465,6 +470,15 @@ private void RemoveComments(INode context)
}
}
+ private static void DefaultEncodeLiteralTextElementContent(IElement tag)
+ {
+ var escapedHtml = tag.InnerHtml.Replace("<", "<").Replace(">", ">");
+ if (escapedHtml != tag.InnerHtml)
+ tag.InnerHtml = escapedHtml;
+ if (tag.InnerHtml != escapedHtml) // setting InnerHtml does not work for noscript
+ tag.SetInnerText(escapedHtml);
+ }
+
private void DoSanitize(IHtmlDocument dom, IParentNode context, string baseUrl = "")
{
// remove disallowed tags
@@ -479,11 +493,7 @@ private void DoSanitize(IHtmlDocument dom, IParentNode context, string baseUrl =
&& t.Flags.HasFlag(NodeFlags.LiteralText)
&& !string.IsNullOrWhiteSpace(t.InnerHtml)))
{
- var escapedHtml = tag.InnerHtml.Replace("<", "<").Replace(">", ">");
- if (escapedHtml != tag.InnerHtml)
- tag.InnerHtml = escapedHtml;
- if (tag.InnerHtml != escapedHtml) // setting InnerHtml does not work for noscript
- tag.SetInnerText(escapedHtml);
+ EncodeLiteralTextElementContent(tag);
}
SanitizeStyleSheets(dom, baseUrl);
diff --git a/test/HtmlSanitizer.Tests/Tests.cs b/test/HtmlSanitizer.Tests/Tests.cs
index f01b2db..a8ad6d0 100644
--- a/test/HtmlSanitizer.Tests/Tests.cs
+++ b/test/HtmlSanitizer.Tests/Tests.cs
@@ -3553,6 +3553,21 @@ public void Bypass4Test()
Assert.Equal(expected, sanitized);
}
+ [Fact]
+ public void OverrideLiteralTextElementContentEncoderTest()
+ {
+ var sanitizer = new HtmlSanitizer();
+ sanitizer.AllowedTags.Add("script");
+ sanitizer.EncodeLiteralTextElementContent = (e) =>
+ {
+ // Do nothing - we do not want to encode the custom element inside the ";
+ var sanitized = sanitizer.Sanitize(bypass);
+ var expected = @"";
+ Assert.Equal(expected, sanitized);
+ }
+
[Fact]
public void InlineCssTest()
{