Question

Some of my model properties are marked by AllowHtml attribute. Is there any way to automatically apply AntiXss protection (i. e. filter only allowed tags) to these fields?

Answer 1

There is no automatic way. The closest you can do is to get AntiXss Nuget package. Then you can use it like below in your controller :

  Microsoft.Security.Application.Sanitizer.GetSafeHtml("YourHtml");

OR

  Microsoft.Security.Application.Encoder.HtmlEncode("YourHtml");

If you use you can decode it using

  Server.HtmlDecode("HtmlEncodedString");

Hope this helps.