HtmlToHtmlNoScriptHandling Property

Get or set how <noscript> elements should be handled.

Definition

Namespace: MimeKit.Text
Assembly: MimeKit.Core (in MimeKit.Core.dll) Version: 5.0.0
C#
public HtmlNoScriptHandling NoScriptHandling { get; set; }

Property Value

HtmlNoScriptHandling
The method for handling <noscript> elements.

Remarks

Gets or sets how <noscript> elements should be handled.

The HTML5 specification tokenizes the content of a <noscript> element differently depending on whether scripting is enabled in the application that renders the HTML (see ScriptingEnabled). When scripting is enabled, the content is raw text; when scripting is disabled, the content is normal markup.

  Security Note

If the HtmlTagCallback is being used to filter the HTML (for example, to remove remote images or event handler attributes), then the output is only filtered correctly if the <noscript> content is tokenized the same way that the application that eventually renders the output will interpret it. A mismatch in either direction allows content to bypass the callback:

  • When using ScriptingEnabled, if the output is rendered with scripting disabled (as is typical for email clients), markup inside <noscript> elements, such as tracking images, remote content and forms, is never seen by the callback but is rendered.
  • When using ScriptingDisabled, if the output is rendered with scripting enabled, a </noscript> hidden inside a comment or a raw text element such as <style> within a <noscript> element will close the <noscript> element in the renderer, allowing markup that the callback never saw (including script event handlers) to be rendered. This is a cross-site scripting (XSS) vulnerability.

The default value is Unwrap, which tokenizes the content of <noscript> elements as normal markup (so that it is passed to the HtmlTagCallback) and removes the <noscript> start and end tags from the output. Since the output then contains no <noscript> elements, it is interpreted the same way regardless of whether scripting is enabled in the renderer. The trade-off is that the fallback content of <noscript> elements is always displayed, even by renderers that have scripting enabled.

Note that HtmlToHtml is not an HTML sanitizer. For displaying untrusted HTML, use a dedicated HTML sanitizer library.

Exceptions

See Also