In the intent of preventing XSS attacks, I am updating a page in which we have a textbox that accepts HTML, stores it in a database and retrieves and renders it at a later time.
My understanding is that I can sanitize the HTML using AntiXSS.GetSafeHtmlFragment() method. As long as I do this before storing the HTML in the database, am I covered? Do I need to do anything when the HTML is outputted on a web page?
Also, it appears that the white list is kind of a black box. Is there a way to update this based on our requirements?
You should be set. Though obviously this won't protect you from anything already in the database.
You could use AntiXSS.GetSafeHtmlFragment() while outputting the page instead of when saving. But doing when saving is probably safer. You would not want to do it both while rendering and saving though.
The whitelist is not editable.
In regards to your question about "black box": yes, it's a black box, and my understanding is that you can't edit it. If you're looking for more granularity, check out the AntiSamy.NET project.
In the latest 4.x Anti-XSS libraries, GetSafeHtml() and SetSafeHtmlFragment() are under the Sanitizer class in Microsoft.Security.Application, which was moved to the HtmlSanitizationLibrary assembly.
[Deprecated Link: http://www.microsoft.com/en-us/download/details.aspx?id=28589 ] Update: This looks like it was moved into a NuGet package: https://www.nuget.org/packages/HtmlSanitizationLibrary/
You're almost there. You need to make sure that you choose the proper encoding. For example, if the user input went into a url, you'd need to use AntiXSS.UrlEncode(), and if it went into JavaScript you'd want to use AntiXSS.JavaScriptEncode(). If you can't guarantee when you save the input what the output format will be, it's better to do the sanitizing at output time.
来源：https://stackoverflow.com/questions/2031527/using-ms-anti-xss-library-for-sanitizing-html