HtmlSanitizer | Fast JavaScript HTML Sanitizer , client-side | Runtime Evironment library

Got this error un .net core 5 solution with angular client after enabling lz4BlockArray compression. Without compression everithing seems to work pretty fine. Looking around for motivation but i found nothing. Seems like some decoders aren't loaded correctly.

That's client side error, no server side error

When I use HtmlSanitizer without DI it works well.

HtmlSanitizer without DI:

But when I want to get HtmlSanitizer using DI.

1. I added to Startup.cs file:

   ...

I have the following Custom Model Binder:

I have a ice inline editor where user can paste and type if required, once editing is done i am using ng-blur to save the final content to DB. My concern is user can write or paste anything which might have html like tags or even some suspicious script tags. if there is anything like suspicious code is there my code will consider it as dangerous request. So all i want to do is, on ng-blur if there are any html tags(other than ins and del), they should be removed and my editor should have clean code, so i can get that through get window[varname].getElementContent() method.

for paste, i am using following code

i'm trying to access a WebAPI which is using ValidateAntiForgeryToken. My WebAPI Method is this (a simple one), which is inside a User Controller (just for a test):

I am dynamically updating tabs with content using goog.dom.safeHtmlToNode

since the newer release of the google closure library removed the dom fragment method: goog.dom.htmlToDocumentFragment(htmlString).

The sanitizer removes my "id=xyz" from the dom elements. For example:

I'm trying to prevent execution of unsafe content using ng-bind-html and $sce.trustAsHtml.

But If I put some js inside tag(for example onerror="alert(123)" ), it is executing the unsafe content.

I have a WebApp with a TinyMCE Html Editor that allows users to input some html from a web page. Images can be pasted and are encoded as base64. Before saving the user input to DB I use OWASP java-html-sanitizer to discard potential dangerous code (javascript,...).

Some characters in the base64 string of the image are escaped and when I try to get the image back (using apache commons Base64) I'm not able to get a valid image.

Here my code for decoding the image:

I have a C# class library project called Helpers which uses the nuget called HtmlSanitizer.

In my web application (which is located inside the same solution), I'm referencing the Helpers project. When I call one of the helper methods that instantiates a HtmlSanitizer, I get the following error:

Method not found: 'Void Ganss.XSS.HtmlSanitizer..ctor(…)'

The error disappears if I add the HtmlSanitizer nuget to the web application.

Since my Helpers project is used in many other projects and web applications (and even referenced in other solutions), it is not viable for me to add the nuget to all of them (imagine the maintenance cost if I have to upgrade the version or use a different nuget…). What's the solution?