Microsoft Anti XSS Library encoding ampersands?

Question

I am currently using the Microsoft AntiXSS library and using the GetSafeHtmlFragment method as follows:

public static string SanitizeHtml(this string s)
{
    return Sanitizer.GetSafeHtmlFragment(s);
}

However, if I pass in a string like this:

black & white

... it is encoding the ampersand so it becomes:

black & white

Is this normal behaviour for this library? Is there a way of preventing it from encoding this character?

Answer 1

Is this normal behaviour for this library?

Yes, it fixes your HTML since you are using GetSafeHtmlFragment. Otherwise you would have ended up with invalid HTML fragment. In HTML the & character has special meaning. I don't think this behavior could be modified.

Answer 2

I don't think this is the best solution. If you use HTML.Raw() then you are leaving yourself vulnerable to XSS attacks unless you can be absolutely sure that the string is safe all the time and for all uses of HTML.Raw().