initial commit

.gitignore

@@ -0,0 +1,148 @@
+## Ignore Visual Studio temporary files, build results, and
+## files generated by popular Visual Studio add-ons.
+
+# User-specific files
+*.suo
+*.user
+*.sln.docstates
+
+# Build results
+
+[Dd]ebug/
+[Rr]elease/
+x64/
+build/
+[Bb]in/
+[Oo]bj/
+
+# MSTest test Results
+[Tt]est[Rr]esult*/
+[Bb]uild[Ll]og.*
+
+*_i.c
+*_p.c
+*.ilk
+*.meta
+*.obj
+*.pch
+*.pdb
+*.pgc
+*.pgd
+*.rsp
+*.sbr
+*.tlb
+*.tli
+*.tlh
+*.tmp
+*.tmp_proj
+*.log
+*.vspscc
+*.vssscc
+.builds
+*.pidb
+*.log
+*.scc
+
+# Visual C++ cache files
+ipch/
+*.aps
+*.ncb
+*.opensdf
+*.sdf
+*.cachefile
+
+# Visual Studio profiler
+*.psess
+*.vsp
+*.vspx
+
+# Guidance Automation Toolkit
+*.gpState
+
+# ReSharper is a .NET coding add-in
+_ReSharper*/
+*.[Rr]e[Ss]harper
+
+# TeamCity is a build add-in
+_TeamCity*
+
+# DotCover is a Code Coverage Tool
+*.dotCover
+
+# NCrunch
+*.ncrunch*
+.*crunch*.local.xml
+
+# Installshield output folder
+[Ee]xpress/
+
+# DocProject is a documentation generator add-in
+DocProject/buildhelp/
+DocProject/Help/*.HxT
+DocProject/Help/*.HxC
+DocProject/Help/*.hhc
+DocProject/Help/*.hhk
+DocProject/Help/*.hhp
+DocProject/Help/Html2
+DocProject/Help/html
+
+# Click-Once directory
+publish/
+
+# Publish Web Output
+*.Publish.xml
+*.pubxml
+
+# NuGet Packages Directory
+## TODO: If you have NuGet Package Restore enabled, uncomment the next line
+#packages/
+
+# Windows Azure Build Output
+csx
+*.build.csdef
+
+# Windows Store app package directory
+AppPackages/
+
+# Others
+sql/
+*.Cache
+ClientBin/
+[Ss]tyle[Cc]op.*
+~$*
+*~
+*.dbmdl
+*.[Pp]ublish.xml
+*.pfx
+*.publishsettings
+
+# RIA/Silverlight projects
+Generated_Code/
+
+# Backup & report files from converting an old project file to a newer
+# Visual Studio version. Backup files are not needed, because we have git ;-)
+_UpgradeReport_Files/
+Backup*/
+UpgradeLog*.XML
+UpgradeLog*.htm
+
+# SQL Server files
+App_Data/*.mdf
+App_Data/*.ldf
+
+# =========================
+# Windows detritus
+# =========================
+
+# Windows image file caches
+Thumbs.db
+ehthumbs.db
+
+# Folder config file
+Desktop.ini
+
+# Recycle Bin used on file shares
+$RECYCLE.BIN/
+
+# Mac crap
+.DS_Store

App.config

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<configuration>
+  <startup>
+    <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
+  </startup>
+</configuration>

HtmlSanitizer.cs

@@ -0,0 +1,367 @@
+using CsQuery;
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text.RegularExpressions;
+
+namespace Html
+{
+    public class HtmlSanitizer
+    {
+        private IEnumerable<string> _allowedSchemes;
+
+        /// <summary>
+        /// Gets or sets the allowed HTTP schemes such as "http" and "https".
+        /// </summary>
+        /// <value>
+        /// The allowed HTTP schemes.
+        /// </value>
+        public IEnumerable<string> AllowedSchemes
+        {
+            get { return _allowedSchemes ?? DefaultAllowedSchemes; }
+            set { _allowedSchemes = value; }
+        }
+
+        /// <summary>
+        /// The default allowed HTTP schemes.
+        /// </summary>
+        public static readonly IEnumerable<string> DefaultAllowedSchemes = new[] { "http", "https" };
+
+        private IEnumerable<string> _allowedTags;
+
+        /// <summary>
+        /// Gets or sets the allowed HTML tag names such as "a" and "div".
+        /// </summary>
+        /// <value>
+        /// The allowed tag names.
+        /// </value>
+        public IEnumerable<string> AllowedTags
+        {
+            get { return _allowedTags ?? DefaultAllowedTags; }
+            set { _allowedTags = value; }
+        }
+
+        /// <summary>
+        /// The default allowed HTML tag names.
+        /// </summary>
+        public static readonly IEnumerable<string> DefaultAllowedTags = new[] { "a", "abbr", "acronym", "address", "area", "b",
+            "big", "blockquote", "br", "button", "caption", "center", "cite",
+            "code", "col", "colgroup", "dd", "del", "dfn", "dir", "div", "dl", "dt",
+            "em", "fieldset", "font", "form", "h1", "h2", "h3", "h4", "h5", "h6",
+            "hr", "i", "img", "input", "ins", "kbd", "label", "legend", "li", "map",
+            "menu", "ol", "optgroup", "option", "p", "pre", "q", "s", "samp",
+            "select", "small", "span", "strike", "strong", "sub", "sup", "table",
+            "tbody", "td", "textarea", "tfoot", "th", "thead", "tr", "tt", "u",
+            "ul", "var" };
+
+        /// <summary>
+        /// Gets or sets the allowed HTML attributes such as "href" and "alt".
+        /// </summary>
+        /// <value>
+        /// The allowed HTML attributes.
+        /// </value>
+        public IEnumerable<string> AllowedAttributes
+        {
+            get { return AllowedAttributesSet.ToArray(); }
+            set
+            {
+                AllowedAttributesSet = new HashSet<string>(value, StringComparer.OrdinalIgnoreCase);
+            }
+        }
+
+        private HashSet<string> _allowedAttributesSet;
+
+        private HashSet<string> AllowedAttributesSet
+        {
+            get { return _allowedAttributesSet ?? DefaultAllowedAttributesSet; }
+            set { _allowedAttributesSet = value; }
+        }
+
+        /// <summary>
+        /// The default allowed HTML attributes.
+        /// </summary>
+        public static readonly IEnumerable<string> DefaultAllowedAttributes = new[] { "abbr", "accept", "accept-charset", "accesskey",
+            "action", "align", "alt", "axis", "bgcolor", "border", "cellpadding",
+            "cellspacing", "char", "charoff", "charset", "checked", "cite", /* "class", */
+            "clear", "cols", "colspan", "color", "compact", "coords", "datetime",
+            "dir", "disabled", "enctype", "for", "frame", "headers", "height",
+            "href", "hreflang", "hspace", /* "id", */ "ismap", "label", "lang",
+            "longdesc", "maxlength", "media", "method", "multiple", "name",
+            "nohref", "noshade", "nowrap", "prompt", "readonly", "rel", "rev",
+            "rows", "rowspan", "rules", "scope", "selected", "shape", "size",
+            "span", "src", "start", "style", "summary", "tabindex", "target", "title",
+            "type", "usemap", "valign", "value", "vspace", "width" };
+        private static HashSet<string> DefaultAllowedAttributesSet = new HashSet<string>(DefaultAllowedAttributes, StringComparer.OrdinalIgnoreCase);
+
+        private IEnumerable<string> _uriAttributes;
+
+        /// <summary>
+        /// Gets or sets the HTML attributes that can contain a URI.
+        /// </summary>
+        /// <value>
+        /// The URI attributes.
+        /// </value>
+        public IEnumerable<string> UriAttributes
+        {
+            get { return _uriAttributes ?? DefaultUriAttributes; }
+            set { _uriAttributes = value; }
+        }
+
+        /// <summary>
+        /// The default URI attributes.
+        /// </summary>
+        public static readonly IEnumerable<string> DefaultUriAttributes = new[] { "action", "background", "dynsrc", "href", "lowsrc", "src" };
+
+        /// <summary>
+        /// Gets or sets the allowed CSS properties.
+        /// </summary>
+        /// <value>
+        /// The allowed CSS properties.
+        /// </value>
+        public IEnumerable<string> AllowedCssProperties
+        {
+            get { return AllowedCssPropertiesSet.ToArray(); }
+            set
+            {
+                AllowedCssPropertiesSet = new HashSet<string>(value, StringComparer.OrdinalIgnoreCase);
+            }
+        }
+
+        private HashSet<string> _allowedCssPropertiesSet;
+
+        private HashSet<string> AllowedCssPropertiesSet
+        {
+            get { return _allowedCssPropertiesSet ?? DefaultAllowedCssPropertiesSet; }
+            set { _allowedCssPropertiesSet = value; }
+        }
+
+        /// <summary>
+        /// The default allowed CSS properties.
+        /// </summary>
+        public static readonly IEnumerable<string> DefaultAllowedCssProperties = new[] { 
+            // CSS 3 properties <http://www.w3.org/TR/CSS/#properties>
+            "background", "background-attachment", "background-color",
+            "background-image", "background-position", "background-repeat",
+            "border", "border-bottom", "border-bottom-color",
+            "border-bottom-style", "border-bottom-width", "border-collapse",
+            "border-color", "border-left", "border-left-color",
+            "border-left-style", "border-left-width", "border-right",
+            "border-right-color", "border-right-style", "border-right-width",
+            "border-spacing", "border-style", "border-top", "border-top-color",
+            "border-top-style", "border-top-width", "border-width", "bottom",
+            "caption-side", "clear", "clip", "color", "content",
+            "counter-increment", "counter-reset", "cursor", "direction", "display",
+            "empty-cells", "float", "font", "font-family", "font-size",
+            "font-style", "font-variant", "font-weight", "height", "left",
+            "letter-spacing", "line-height", "list-style", "list-style-image",
+            "list-style-position", "list-style-type", "margin", "margin-bottom",
+            "margin-left", "margin-right", "margin-top", "max-height", "max-width",
+            "min-height", "min-width", "opacity", "orphans", "outline",
+            "outline-color", "outline-style", "outline-width", "overflow",
+            "padding", "padding-bottom", "padding-left", "padding-right",
+            "padding-top", "page-break-after", "page-break-before",
+            "page-break-inside", "quotes", "right", "table-layout",
+            "text-align", "text-decoration", "text-indent", "text-transform",
+            "top", "unicode-bidi", "vertical-align", "visibility", "white-space",
+            "widows", "width", "word-spacing", "z-index" };
+        private static HashSet<string> DefaultAllowedCssPropertiesSet = new HashSet<string>(DefaultAllowedCssProperties, StringComparer.OrdinalIgnoreCase);
+
+        private Regex _disallowedCssPropertyValue;
+
+        /// <summary>
+        /// Gets or sets a regex that must not match for legal CSS property values.
+        /// </summary>
+        /// <value>
+        /// The regex.
+        /// </value>
+        public Regex DisallowCssPropertyValue
+        {
+            get { return _disallowedCssPropertyValue ?? DefaultDisallowedCssPropertyValue; }
+            set { _disallowedCssPropertyValue = value; }
+        }
+
+        /// <summary>
+        /// The default regex for disallowed CSS property values.
+        /// </summary>
+        public static readonly Regex DefaultDisallowedCssPropertyValue = new Regex(@"[<>]", RegexOptions.Compiled);
+
+        /// <summary>
+        /// The regex for Javascript includes (see https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#.26_JavaScript_includes)
+        /// </summary>
+        protected static readonly Regex JSInclude = new Regex(@"\s*&{");
+
+        /// <summary>
+        /// Sanitizes the specified HTML.
+        /// </summary>
+        /// <param name="html">The HTML to sanitize.</param>
+        /// <param name="baseUrl">The base URL relative URLs are resolved against. No resolution if empty.</param>
+        /// <returns>The sanitized HTML.</returns>
+        public string Sanitize(string html, string baseUrl = "")
+        {
+            var dom = CQ.Create(html);
+
+            dom["*"].Not(string.Join(",", AllowedTags.ToArray())).Remove();
+            foreach (var tag in dom["*"])
+            {
+                foreach (var attribute in tag.Attributes.Where(a => !AllowedAttributesSet.Contains(a.Key)).ToList())
+                    tag.RemoveAttribute(attribute.Key);
+
+                foreach (var attribute in tag.Attributes.Where(a => UriAttributes.Contains(a.Key)).ToList())
+                {
+                    var url = SanitizeUrl(attribute.Value, baseUrl);
+                    if (url == null)
+                        tag.RemoveAttribute(attribute.Key);
+                    else
+                        tag.SetAttribute(attribute.Key, url);
+                }
+
+                SanitizeStyle(tag.Style, baseUrl);
+
+                foreach (var attribute in tag.Attributes.ToList())
+                {
+                    if (JSInclude.IsMatch(attribute.Value))
+                        tag.RemoveAttribute(attribute.Key);
+
+                    var val = attribute.Value;
+                    if (val.Contains('<')) { val = val.Replace("<", "&lt;"); tag.SetAttribute(attribute.Key, val); }
+                    if (val.Contains('>')) { val = val.Replace(">", "&gt;"); tag.SetAttribute(attribute.Key, val); }
+                }
+            }
+
+            var output = dom.Render(DomRenderingOptions.RemoveComments | DomRenderingOptions.QuoteAllAttributes);
+
+            return output;
+        }
+
+        // frolm http://genshi.edgewall.org/
+        protected static readonly Regex CssUnicodeEscapes = new Regex(@"\\([0-9a-fA-F]{1,6})\s?|\\([^\r\n\f0-9a-fA-F'""{};:()#*])", RegexOptions.Compiled);
+        protected static readonly Regex CssComments = new Regex(@"/\*.*?\*/", RegexOptions.Compiled);
+        // IE6 <http://heideri.ch/jso/#80>
+        protected static readonly Regex CssExpression = new Regex(@"[eE\uFF25\uFF45][xX\uFF38\uFF58][pP\uFF30\uFF50][rR\u0280\uFF32\uFF52][eE\uFF25\uFF45][sS\uFF33\uFF53]{2}[iI\u026A\uFF29\uFF49][oO\uFF2F\uFF4F][nN\u0274\uFF2E\uFF4E]", RegexOptions.Compiled);
+        protected static readonly Regex CssUrl = new Regex(@"[Uu][Rr\u0280][Ll\u029F]\s*\(\s*['""]?\s*([^'"")]+)", RegexOptions.Compiled);
+
+        /// <summary>
+        /// Sanitizes the style.
+        /// </summary>
+        /// <param name="styles">The styles.</param>
+        /// <param name="baseUrl">The base URL.</param>
+        protected void SanitizeStyle(CsQuery.Implementation.CSSStyleDeclaration styles, string baseUrl)
+        {
+            if (styles == null || !styles.Any()) return;
+
+            var removeStyles = new List<string>();
+            var setStyles = new Dictionary<string, string>();
+
+            foreach (var style in styles)
+            {
+                var key = DecodeCss(style.Key);
+                var val = DecodeCss(style.Value);
+
+                if (!AllowedCssPropertiesSet.Contains(key) || CssExpression.IsMatch(val) || DisallowCssPropertyValue.IsMatch(val))
+                    removeStyles.Add(style.Key);
+                else
+                {
+                    var urls = CssUrl.Matches(val);
+
+                    if (urls.Count > 0)
+                    {
+                        if (urls.Cast<Match>().Any(m => GetSafeUri(m.Groups[1].Value) == null))
+                            removeStyles.Add(style.Key);
+                        else
+                        {
+                            var s = CssUrl.Replace(val, m => "url(" + SanitizeUrl(m.Groups[1].Value, baseUrl));
+                            if (s != val)
+                            {
+                                if (key != style.Key) removeStyles.Add(style.Key);
+                                setStyles[key] = s;
+                            }
+                        }
+                    }
+                }
+            }
+
+            foreach (var key in removeStyles)
+            {
+                styles.RemoveStyle(key);
+            }
+
+            foreach (var kvp in setStyles)
+            {
+                styles.SetStyle(kvp.Key, kvp.Value);
+            }
+        }
+
+        /// <summary>
+        /// Decodes CSS unicode escapes and removes comments.
+        /// </summary>
+        /// <param name="css">The CSS string.</param>
+        /// <returns>The decoded CSS string.</returns>
+        protected static string DecodeCss(string css)
+        {
+            var r = CssUnicodeEscapes.Replace(css, m =>
+            {
+                if (m.Groups[1].Success)
+                    return ((char)int.Parse(m.Groups[1].Value, NumberStyles.HexNumber)).ToString();
+                var t = m.Groups[2].Value;
+                return t == "\\" ? @"\\" : t;
+            });
+
+            r = CssComments.Replace(r, m => "");
+
+            return r;
+        }
+
+        /// <summary>
+        /// Tries to create a safe <see cref="Uri"/> object from a string.
+        /// </summary>
+        /// <param name="url">The URL.</param>
+        /// <returns>The <see cref="Uri"/> object or null if no safe <see cref="Uri"/> can be created.</returns>
+        protected Uri GetSafeUri(string url)
+        {
+            Uri uri;
+            if (!Uri.TryCreate(url, UriKind.RelativeOrAbsolute, out uri)
+                || !uri.IsWellFormedOriginalString() && !IsWellFormedRelativeUri(uri)
+                || uri.IsAbsoluteUri && !AllowedSchemes.Contains(uri.Scheme, StringComparer.OrdinalIgnoreCase)
+                || !uri.IsAbsoluteUri && url.Contains(':')) 
+                return null;
+
+            return uri;
+        }
+
+        private static Uri _exampleUri = new Uri("http://www.example.com/");
+        private static bool IsWellFormedRelativeUri(Uri uri)
+        {
+            if (uri.IsAbsoluteUri) return false;
+
+            Uri absoluteUri;
+            if (!Uri.TryCreate(_exampleUri, uri, out absoluteUri)) return false;
+            var wellFormed = absoluteUri.IsWellFormedOriginalString();
+            return wellFormed;
+        }
+
+        /// <summary>
+        /// Sanitizes a URL.
+        /// </summary>
+        /// <param name="url">The URL.</param>
+        /// <param name="baseUrl">The base URL relative URLs are resolved against (empty or null for no resolution).</param>
+        /// <returns>The sanitized URL or null if no safe URL can be created.</returns>
+        protected string SanitizeUrl(string url, string baseUrl)
+        {
+            var uri = GetSafeUri(url);
+
+            if (uri == null) return null;
+
+            if (!uri.IsAbsoluteUri && !string.IsNullOrEmpty(baseUrl))
+            {
+                // resolve relative uri
+                Uri baseUri;
+                if (Uri.TryCreate(baseUrl, UriKind.Absolute, out baseUri))
+                    uri = new Uri(baseUri, uri.ToString());
+                else return null;
+            }
+
+            return uri.ToString();
+        }
+    }
+}

HtmlSanitizer.csproj

@@ -0,0 +1,70 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{CCDB0C26-D683-4943-B5D8-AC07116461E5}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>Html</RootNamespace>
+    <AssemblyName>HtmlSanitizer</AssemblyName>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <RunCodeAnalysis>false</RunCodeAnalysis>
+    <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <DocumentationFile>bin\Debug\HtmlSanitizer.XML</DocumentationFile>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="CsQuery">
+      <HintPath>packages\CsQuery.1.3.4\lib\net40\CsQuery.dll</HintPath>
+    </Reference>
+    <Reference Include="nunit.framework, Version=2.6.2.12296, Culture=neutral, PublicKeyToken=96d09a1eb7f44a77, processorArchitecture=MSIL">
+      <HintPath>packages\NUnit.2.6.2\lib\nunit.framework.dll</HintPath>
+    </Reference>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="System.Data.DataSetExtensions" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="System.Data" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="HtmlSanitizer.cs" />
+    <Compile Include="Program.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Tests.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="App.config" />
+    <None Include="packages.config" />
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
+       Other similar extension points exist, see Microsoft.Common.targets.
+  <Target Name="BeforeBuild">
+  </Target>
+  <Target Name="AfterBuild">
+  </Target>
+  -->
+</Project>

HtmlSanitizer.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2012
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "HtmlSanitizer", "HtmlSanitizer.csproj", "{CCDB0C26-D683-4943-B5D8-AC07116461E5}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{CCDB0C26-D683-4943-B5D8-AC07116461E5}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{CCDB0C26-D683-4943-B5D8-AC07116461E5}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{CCDB0C26-D683-4943-B5D8-AC07116461E5}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{CCDB0C26-D683-4943-B5D8-AC07116461E5}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

Program.cs

@@ -0,0 +1,17 @@
+using System;
+using System.Linq;
+using System.Text;
+
+namespace Html
+{
+    class Program
+    {
+        static void Main(string[] args)
+        {
+            var html = Console.In.ReadToEnd();
+            var sanitized = new HtmlSanitizer().Sanitize(html, args.Any() ? args[0] : "");
+            Console.OutputEncoding = Encoding.UTF8;
+            Console.Out.Write(sanitized);
+        }
+    }
+}

Properties/AssemblyInfo.cs

@@ -0,0 +1,36 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following 
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("HtmlSanitizer")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("HtmlSanitizer")]
+[assembly: AssemblyCopyright("Copyright ©  2013")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible 
+// to COM components.  If you need to access a type in this assembly from 
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("16af04e9-e712-417e-b749-c8d10148dda9")]
+
+// Version information for an assembly consists of the following four values:
+//
+//      Major Version
+//      Minor Version 
+//      Build Number
+//      Revision
+//
+// You can specify all the values or you can default the Build and Revision Numbers 
+// by using the '*' as shown below:
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]

packages.config

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="CsQuery" version="1.3.4" targetFramework="net45" />
+  <package id="NUnit" version="2.6.2" targetFramework="net45" />
+</packages>

packages/CsQuery.1.3.4/CsQuery.1.3.4.nuspec

@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
+  <metadata>
+    <id>CsQuery</id>
+    <version>1.3.4</version>
+    <title>CsQuery</title>
+    <authors>James Treworgy</authors>
+    <owners>James Treworgy</owners>
+    <licenseUrl>https://github.com/jamietre/CsQuery/blob/master/LICENSE.txt</licenseUrl>
+    <projectUrl>https://github.com/jamietre/CsQuery/</projectUrl>
+    <iconUrl>http://www.outsharked.com/csquery/images/csquery-icon-large.gif</iconUrl>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+    <description>CsQuery is an HTML parser, CSS selector engine and jQuery port for .NET 4 and C#. It implements all CSS2 and CSS3 selectors, all the DOM manipulation methods of jQuery, and some of the utility methods.</description>
+    <summary>A complete CSS selector engine and jQuery port for .NET 4 and C#.</summary>
+    <releaseNotes>Version 1.3 is a major release. It implements a new C# port of the validator.nu HTML5 parser, a fully HTML5 compliant HTML parser.
+
+Version 1.3.2 now handles the character set encoding properly when using HTTP get methods, as well as an encoding specified in META tags. It also contains bug fixes.
+
+Complete change log:
+https://github.com/jamietre/CsQuery/blob/master/source/README.md</releaseNotes>
+    <copyright>Copyright 2012</copyright>
+    <language />
+    <tags>jquery html</tags>
+  </metadata>
+</package>

packages/NUnit.2.6.2/NUnit.2.6.2.nuspec

@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2011/08/nuspec.xsd">
+  <metadata>
+    <id>NUnit</id>
+    <version>2.6.2</version>
+    <title>NUnit</title>
+    <authors>Charlie Poole</authors>
+    <owners>Charlie Poole</owners>
+    <licenseUrl>http://nunit.org/nuget/license.html</licenseUrl>
+    <projectUrl>http://nunit.org/</projectUrl>
+    <iconUrl>http://nunit.org/nuget/nunit_32x32.png</iconUrl>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+    <description>NUnit features a fluent assert syntax, parameterized, generic and theory tests and is user-extensible. A number of runners, both from the NUnit project and by third parties, are able to execute NUnit tests.
+
+Version 2.6 is the seventh major release of this well-known and well-tested programming tool.
+
+This package includes only the framework assembly. You will need to install the NUnit.Runners package unless you are using a third-party runner.</description>
+    <summary>NUnit is a unit-testing framework for all .Net languages with a strong TDD focus.</summary>
+    <releaseNotes>Version 2.6 is the seventh major release of NUnit.
+
+Unlike earlier versions, this package includes only the framework assembly. You will need to install the NUnit.Runners package unless you are using a third-party runner.
+
+The nunit.mocks assembly is now provided by the NUnit.Mocks package. The pnunit.framework assembly is provided by the pNUnit package.</releaseNotes>
+    <copyright />
+    <language>en-US</language>
+    <tags>test testing tdd framework fluent assert theory plugin addin</tags>
+  </metadata>
+</package>

packages/NUnit.2.6.2/license.txt

@@ -0,0 +1,15 @@
+Copyright <20> 2002-2012 Charlie Poole
+Copyright <20> 2002-2004 James W. Newkirk, Michael C. Two, Alexei A. Vorontsov
+Copyright <20> 2000-2002 Philip A. Craig
+
+This software is provided 'as-is', without any express or implied warranty. In no event will the authors be held liable for any damages arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose, including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment (see the following) in the product documentation is required.
+
+Portions Copyright <20> 2002-2012 Charlie Poole or Copyright <20> 2002-2004 James W. Newkirk, Michael C. Two, Alexei A. Vorontsov or Copyright <20> 2000-2002 Philip A. Craig
+
+2. Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.
+
+3. This notice may not be removed or altered from any source distribution.

packages/repositories.config

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<repositories>
+  <repository path="..\packages.config" />
+</repositories>