title: Ajax Control Toolkit HtmlEditorExtender: Xss Attacks
body: <p>I'm using Ajax Control Toolkit in my ASP.NET project and I have a problem with <em>HtmlEditorExtender</em> which name is <strong>ContentHtmlEditor</strong>. <em>HtmlEditorExtender</em> attached to <em>TextBox</em> which name is <strong>ContentBox</strong>.</p>
  
  <p>I tried to make an XSS Atack. I edited html code with Chrome and inserted the following string:</p>
  
  <pre><code>&lt;a href='javascript:alert()'&gt;bla-bla-bla&lt;/a&gt;
  </code></pre>
  
  <p>After post back <strong>ContentBox.Text</strong> equals to <strong>&lt;a href=&quot;javascript:alert()&quot;&gt;bla-bla-bla&lt;/a&gt;</strong>.</p>
  
  <p>As you can see <strong>javascript:alert()</strong> hasn't been removed but as I know Ajax Control Toolkit HtmlEditorExtender is using AntiXss Sanitizer.</p>
  
  <p>When I call</p>
  
  <pre><code>ContentHtmlEditor.SanitizerProvider.GetSafeHtmlFragment("&lt;a href='javascript:alert()'&gt;bla-bla-bla&lt;/a&gt;")
  </code></pre>
  
  <p>it returns:</p>
  
  <pre><code>&lt;a&gt;bla-bla-bla&lt;/a&gt;
  </code></pre>
  
  <p>But there is a problem when I call</p>
  
  <pre><code>ContentHtmlEditor.SanitizerProvider.GetSafeHtmlFragment("&lt;a href='http://somesite.com'&gt;bla-bla-bla&lt;/a&gt;")
  </code></pre>
  
  <p>because then it returns the same string:</p>
  
  <pre><code>&lt;a&gt;bla-bla-bla&lt;/a&gt;
  </code></pre>
  
  <p>but I need to know the reference if the link.</p>
  
  <p>What is the problem? And how can I prevent Xss Attacks on my site?</p>