Throws exception on multiple recipients in a email. about htmlsanitizer HOT 6 CLOSED

This is unlikely to change the result, but I did note in RFC 2368 that the comma should apparently be encoded. See http://www.ietf.org/rfc/rfc2368.txt and in particular the example at the end of page 1.

From: Alexander [mailto:[email protected]]
Sent: 07 August 2015 17:38
To: mganss/HtmlSanitizer [email protected]
Subject: [HtmlSanitizer] Throws exception on multiple recipients in a email. (#41)

Sanitize the following html with enabled mailto: scheme:

Bang Bang

Actual:

System.UriFormatException : Invalid URI: The hostname could not be parsed.
at System.Uri.CreateHostStringHelper(String str, UInt16 idx, UInt16 end, ref Flags flags, ref String scopeId)
at System.Uri.CreateHostString()
at System.Uri.GetComponentsHelper(UriComponents uriComponents, UriFormat uriFormat)
at System.Uri.GetComponents(UriComponents components, UriFormat format)
at System.Uri.get_AbsoluteUri()
at Ganss.XSS.HtmlSanitizer.SanitizeUrl(String url, String baseUrl)
at Ganss.XSS.HtmlSanitizer.Sanitize(String html, String baseUrl, IOutputFormatter outputFormatter)

Expected:
No exception is thrown.

—
Reply to this email directly or view it on GitHub #41 . https://github.com/notifications/beacon/AAdzyfApWqVifRBd-YwDFboS6sleQdlcks5olNaDgaJpZM4Fnq7y.gif

from htmlsanitizer.

I think HtmlSanitizer should "eat" the exception?

from htmlsanitizer.

@Jawvig seems like System.Uri is not very consistent. For example, I could not reproduce the same behaviour for http: scheme.
So, I agree with @304NotModified. Probably, ignoring exception and stripping "invalid" href is way to go.

from htmlsanitizer.

Some info about the (annoying) system uri. See #8
http://blogs.msdn.com/b/ncl/archive/2010/02/23/system-uri-f-a-q.aspx

from htmlsanitizer.

Ps @mganss great covery results!

from htmlsanitizer.

@Jawvig RFC 2368 was superseded by RFC 6068 which allows unencoded commas:

mailtoURI    = "mailto:" [ to ] [ hfields ]
to           = addr-spec *("," addr-spec )
...

In .NET 4.5 and above no exception is thrown because Uri.TryCreate() returns false and the URI is stripped. But of course this means that System.Uri is currently not compliant with RFC 6068 and Microsoft doesn't seem to have the intention to fix it soon: https://connect.microsoft.com/VisualStudio/feedback/details/794758/system-uri-incorrectly-rejects-mailto-uris

I agree that the best way to deal with this issue is to catch the exception and strip the URI although it's legal. If someone insisted on keeping these kinds of URIs, they'd have to handle RemovingAttribute and check the URI themselves.

@304NotModified Thanks 😄

from htmlsanitizer.