Merge branch 'master' into AngleSharp_0_10

src/HtmlSanitizer/EventArgs.cs

@@ -212,4 +212,26 @@ namespace Ganss.XSS
         /// </value>
         public RemoveReason Reason { get; set; }
     }
+
+    /// <summary>
+    /// Provides data for the <see cref="HtmlSanitizer.FilterUrl"/> event.
+    /// </summary>
+    public class FilterUrlEventArgs: EventArgs
+    {
+        /// <summary>
+        /// Gets or sets the original URL.
+        /// </summary>
+        /// <value>
+        /// The original URL.
+        /// </value>
+        public string OriginalUrl { get; set; }
+
+        /// <summary>
+        /// Gets or sets the sanitized URL.
+        /// </summary>
+        /// <value>
+        /// The sanitized URL. If it is null, it will be removed.
+        /// </value>
+        public string SanitizedUrl { get; set; }
+    }
 }

src/HtmlSanitizer/HtmlSanitizer.cs

@@ -324,6 +324,10 @@ namespace Ganss.XSS
         /// Occurs before a CSS class is removed.
         /// </summary>
         public event EventHandler<RemovingCssClassEventArgs> RemovingCssClass;
+        /// <summary>
+        /// Occurs when a URL is being sanitized.
+        /// </summary>
+        public event EventHandler<FilterUrlEventArgs> FilterUrl;
 
         /// <summary>
         /// Raises the <see cref="E:PostProcessDom" /> event.
@@ -402,6 +406,15 @@ namespace Ganss.XSS
             RemovingCssClass?.Invoke(this, e);
         }
 
+        /// <summary>
+        /// Raises the <see cref="E:RemovingUrl" /> event.
+        /// </summary>
+        /// <param name="e">The <see cref="FilterUrlEventArgs"/> instance containing the event data.</param>
+        protected virtual void OnFilteringUrl(FilterUrlEventArgs e)
+        {
+            FilterUrl?.Invoke(this, e);
+        }
+
         /// <summary>
         /// Return all nested subnodes of a node.
         /// </summary>
@@ -824,13 +837,11 @@ namespace Ganss.XSS
         /// <param name="url">The URL.</param>
         /// <param name="baseUrl">The base URL relative URLs are resolved against (empty or null for no resolution).</param>
         /// <returns>The sanitized URL or null if no safe URL can be created.</returns>
-        protected string SanitizeUrl(string url, string baseUrl)
+        protected virtual string SanitizeUrl(string url, string baseUrl)
         {
             var iri = GetSafeIri(url);
 
-            if (iri == null) return null;
-
-            if (!iri.IsAbsolute && !string.IsNullOrEmpty(baseUrl))
+            if (iri != null && !iri.IsAbsolute && !string.IsNullOrEmpty(baseUrl))
             {
                 // resolve relative uri
                 if (Uri.TryCreate(baseUrl, UriKind.Absolute, out Uri baseUri))
@@ -841,13 +852,16 @@ namespace Ganss.XSS
                     }
                     catch (UriFormatException)
                     {
-                        return null;
+                        iri = null;
                     }
                 }
-                else return null;
+                else iri = null;
             }
 
-            return iri.Value;
+            var e = new FilterUrlEventArgs { OriginalUrl = url, SanitizedUrl = iri?.Value };
+            OnFilteringUrl(e);
+
+            return e.SanitizedUrl;
         }
 
         /// <summary>

test/HtmlSanitizer.Tests/Tests.cs

@@ -3082,6 +3082,21 @@ zqy1QY1kkPOuMvKWvvmFIwClI2393jVVcp91eda4+J+fIYDbfJa7RY5YcNrZhTuV//9k="">
 
             Assert.Equal(html, actual);
         }
+
+        [Fact]
+        public void FilterUrlTest()
+        {
+            // https://github.com/mganss/HtmlSanitizer/issues/156
+
+            var sanitizer = new HtmlSanitizer();
+            sanitizer.FilterUrl += (s, e) => e.SanitizedUrl = "https://www.example.com/test.png";
+
+            var html = @"<img src=""http://www.example.com/"">";
+
+            var actual = sanitizer.Sanitize(html);
+
+            Assert.Equal(@"<img src=""https://www.example.com/test.png"">", actual);
+        }
     }
 }