Orchardcore Sanitizer

Orchard Core Sanitizer - Prompt Templates

Configure HTML Sanitization

You are an Orchard Core expert. Generate HTML sanitization configurations and custom sanitizer settings for Orchard Core.

Guidelines

• The HTML Sanitizer is part of Orchard Core's infrastructure — no additional feature needs to be enabled.
• The sanitizer prevents XSS attacks by cleaning user-provided HTML content.
• It is used by default for HtmlBodyPart, HtmlField, HtmlMenuItemPart, MarkdownBodyPart, and MarkdownField.
• Sanitization can be disabled per field/part via the Sanitize Html option in field or part settings.
• Use the @Orchard.SanitizeHtml() Razor helper to sanitize HTML in views.
• Orchard Core customizes the default HtmlSanitizer by allowing the class attribute, allowing mailto and tel schemes, and removing the form tag.
• Configure the sanitizer using ConfigureHtmlSanitizer during service registration.
• Multiple ConfigureHtmlSanitizer calls can be chained in the startup pipeline.
• The sanitizer is based on the HtmlSanitizer library.
• Always seal classes.

Parts and Fields Using the Sanitizer

Orchard Core Default Sanitizer Customizations

Orchard Core modifies the base HtmlSanitizer defaults:

Sanitizing HTML in Razor Views

@Orchard.SanitizeHtml((string)Model.ContentItem.HtmlBodyPart.Html)

This renders the sanitized HTML, stripping any potentially dangerous tags, attributes, or scripts.

Configuring the Sanitizer in Program.cs

builder.Services
    .AddOrchardCms()
    .ConfigureServices(tenantServices =>
        tenantServices.ConfigureHtmlSanitizer((sanitizer) =>
        {
            // Allow additional URI schemes.
            sanitizer.AllowedSchemes.Add("ftp");
            sanitizer.AllowedSchemes.Add("data");
        }));

Allowing Additional Tags

builder.Services
    .AddOrchardCms()
    .ConfigureServices(tenantServices =>
        tenantServices.ConfigureHtmlSanitizer((sanitizer) =>
        {
            // Allow <iframe> tags for embedded content.
            sanitizer.AllowedTags.Add("iframe");
        }));

Allowing Additional Attributes

builder.Services
    .AddOrchardCms()
    .ConfigureServices(tenantServices =>
        tenantServices.ConfigureHtmlSanitizer((sanitizer) =>
        {
            // Allow data attributes and srcset.
            sanitizer.AllowedAttributes.Add("data-*");
            sanitizer.AllowedAttributes.Add("srcset");
        }));

Removing Tags from the Allow List

builder.Services
    .AddOrchardCms()
    .ConfigureServices(tenantServices =>
        tenantServices.ConfigureHtmlSanitizer((sanitizer) =>
        {
            // Remove <script> and <style> tags (removed by default, but shown for illustration).
            sanitizer.AllowedTags.Remove("script");
            sanitizer.AllowedTags.Remove("style");
        }));

Combining Multiple Sanitizer Configurations

builder.Services
    .AddOrchardCms()
    .ConfigureServices(tenantServices =>
        tenantServices.ConfigureHtmlSanitizer((sanitizer) =>
        {
            // Allow iframes for video embeds.
            sanitizer.AllowedTags.Add("iframe");

            // Allow data attributes for JavaScript frameworks.
            sanitizer.AllowedAttributes.Add("data-*");

            // Allow additional URI schemes.
            sanitizer.AllowedSchemes.Add("ftp");

            // Allow the target attribute on links.
            sanitizer.AllowedAttributes.Add("target");
        }));

Disabling Sanitization on a Field or Part

To disable sanitization for a specific field or part:

1. Navigate to the content type definition in the admin UI.
2. Edit the field or part settings (e.g., HtmlBodyPart).
3. Uncheck the Sanitize Html option.

This is useful when trusted editors need to use HTML that would otherwise be stripped (e.g., embedded scripts, custom forms).

Common Sanitizer Configuration Scenarios