Ganss.Xss GDS-Style HTML Allowlist Configuration

Configure Ganss.Xss.HtmlSanitizer with GDS-compliant tag allowlists and attribute filtering.

1|Updated Dec 23, 2025
One-click install
npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill ganss-xss-gds-style-html-allowlist-configuration
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Ganss.Xss GDS-Style HTML Allowlist Configuration
Source: https://github.com/jonnymuir/Umbraco.Prism/tree/main/.claude/skills/ganss-xss-gds-allowlist
Command: npx skills add https://github.com/jonnymuir/Umbraco.Prism --skill ganss-xss-gds-style-html-allowlist-configuration

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires Ganss.Xss, AngleSharp.

What problem does it solve?

This skill addresses the security risks associated with rendering user-authored HTML content by providing a strict, auditable, and GDS-aligned allowlist configuration for the Ganss.Xss.HtmlSanitizer library.

Core Features & Use Cases

  • Strict Tag Allowlisting: Explicitly defines permitted HTML tags while stripping all others to prevent XSS attacks.
  • Attribute Enforcement: Implements per-tag attribute validation to ensure only safe, expected attributes are preserved.
  • External Link Hardening: Automatically injects security attributes like rel=noopener noreferrer on external links to prevent tab-nabbing.
  • Use Case: Ideal for CMS backoffices or workflow engines where administrators input rich text that must be rendered safely on the frontend.

Quick Start

Configure the workflow content sanitizer by applying the provided C# pattern to your dependency injection container as a singleton service.

Frequently Asked Questions about Ganss.Xss GDS-Style HTML Allowlist Configuration

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sanitize HTML input in a .NET web application to prevent XSS attacks?

To sanitize HTML input and prevent XSS in .NET, this skill configures the Ganss.Xss.HtmlSanitizer with a strict GDS-compliant allowlist. It explicitly permits safe tags while stripping all others, securing operator-authored rich-text rendered via Html.Raw.

How do I configure Ganss.Xss to add rel=noopener noreferrer to external links automatically?

Configuring Ganss.Xss to automatically inject rel=noopener noreferrer on external links prevents tab-nabbing. This skill provides a C# dependency injection pattern that enforces external link hardening as part of its strict GDS-aligned HTML sanitization configuration.

What is the best way to securely render CMS rich-text content in .NET without exposing XSS vulnerabilities?

The best way to securely render CMS rich-text in .NET is applying a strict HTML sanitization allowlist. This skill configures Ganss.Xss to perform per-tag attribute filtering and URI scheme validation, ensuring only safe, expected attributes are preserved during frontend rendering.

Does Ganss.Xss support per-tag attribute filtering for GDS-compliant HTML sanitization?

Yes, Ganss.Xss supports per-tag attribute filtering for GDS-compliant HTML sanitization. This skill applies an explicit C# configuration pattern that enforces strict tag allowlisting and attribute validation to securely process untrusted rich-text input in .NET applications.

Why does Html.Raw render untrusted HTML safely with a GDS-style allowlist configuration?

Html.Raw renders untrusted HTML safely when paired with a GDS-style allowlist because the sanitizer strips dangerous tags and validates URI schemes before rendering. This skill provides the auditable configuration needed to process administrator-authored content without XSS risks.

Can I use AngleSharp with Ganss.Xss to enforce strict URI scheme validation in .NET?

Yes, you can use AngleSharp with Ganss.Xss to enforce strict URI scheme validation in .NET. This skill leverages both dependencies to apply GDS-aligned sanitization, filtering attributes and validating external links to secure untrusted rich-text input.