Just wondering if this solution could be built to use the latest version of Html Agility Pack. (currently 1.12.4)

[jhodges13]

Just wondering if this solution could be built to use the latest version of Html Agility Pack. I don't think the code in the Agility pack has changed much, but the latest is 1.12.4 and this package forces use of 1.12.1 which is giving me security scanning hassles as the security admin's want me to use the latest version.

I am a senior developer, but I don't use Git Hub all that much. I can probably download the code and update it myself, not sure how to give you the updated package back or if you would be paranoid cause I touched it. Wondering if you can set a minimum version as a dependency instead of forcing a specific version, that way it becomes somewhat bullet proofed against future changes to agility pack.

[jhodges13]

....Just wanted to add. This project has been a great help to me. Without it, don't think I could allow simple html to be passed safely in a request. That's not something I do regularly, but I do like to give users the ability to content manage aspects of the site themselves and allowing simple html like bold, italic, underline, and paragraphs using a wysiwyg style editor is really helpful and prevents me from having to make the updates for them.

[cakkermans]

Hello @jhodges13, HtmlRuleSanitizer does not require a specific version of the HtmlAgilityPack. It only requires a minimum version of 1.7.1 currently. You should be able to update HtmlAgilityPack in the project using the sanitizer to a newer version.

You mention that for some reason HtmlRuleSanitizer requires you to use HtmlAgilityPack 1.12.1. This should not be the case. Can you provide any details?

[leotsarev]

@cakkermans I think that the security sensitive package should try to force latest and best Html parsing library

[cakkermans]

I had a look at the release notes of the HTML Agility Pack. Version 1.12.0 is the last version which addresses vulnerabilities in dependencies. I like to maximize compatibility, so I'll build the next release on that for now. I hope that's sort of an acceptable compromise for now.