{"action":"created","issue":{"url":"https://api.github.com/repos/mganss/HtmlSanitizer/issues/41","labels_url":"https://api.github.com/repos/mganss/HtmlSanitizer/issues/41/labels{/name}","comments_url":"https://api.github.com/repos/mganss/HtmlSanitizer/issues/41/comments","events_url":"https://api.github.com/repos/mganss/HtmlSanitizer/issues/41/events","html_url":"https://github.com/mganss/HtmlSanitizer/issues/41","id":99684413,"number":41,"title":"Throws exception on multiple recipients in a email.","user":{"login":"shivinsky","id":768780,"avatar_url":"https://avatars.githubusercontent.com/u/768780?v=3","gravatar_id":"","url":"https://api.github.com/users/shivinsky","html_url":"https://github.com/shivinsky","followers_url":"https://api.github.com/users/shivinsky/followers","following_url":"https://api.github.com/users/shivinsky/following{/other_user}","gists_url":"https://api.github.com/users/shivinsky/gists{/gist_id}","starred_url":"https://api.github.com/users/shivinsky/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/shivinsky/subscriptions","organizations_url":"https://api.github.com/users/shivinsky/orgs","repos_url":"https://api.github.com/users/shivinsky/repos","events_url":"https://api.github.com/users/shivinsky/events{/privacy}","received_events_url":"https://api.github.com/users/shivinsky/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-07T16:38:27Z","updated_at":"2015-08-08T19:36:56Z","closed_at":null,"body":"Sanitize the following HTML with enabled `mailto:` scheme:\r\n```html\r\n<a href=\"mailto:bonnie@example.com,clyde@example.com\">Bang Bang</a>\r\n```\r\n**Actual:**\r\n```\r\nSystem.UriFormatException : Invalid URI: The hostname could not be parsed.\r\n   at System.Uri.CreateHostStringHelper(String str, UInt16 idx, UInt16 end, ref Flags flags, ref String scopeId)\r\n   at System.Uri.CreateHostString()\r\n   at System.Uri.GetComponentsHelper(UriComponents uriComponents, UriFormat uriFormat)\r\n   at System.Uri.GetComponents(UriComponents components, UriFormat format)\r\n   at System.Uri.get_AbsoluteUri()\r\n   at Ganss.XSS.HtmlSanitizer.SanitizeUrl(String url, String baseUrl)\r\n   at Ganss.XSS.HtmlSanitizer.Sanitize(String html, String baseUrl, IOutputFormatter outputFormatter)\r\n```\r\n**Expected:**\r\nNo exception is thrown."},"comment":{"url":"https://api.github.com/repos/mganss/HtmlSanitizer/issues/comments/129040309","html_url":"https://github.com/mganss/HtmlSanitizer/issues/41#issuecomment-129040309","issue_url":"https://api.github.com/repos/mganss/HtmlSanitizer/issues/41","id":129040309,"user":{"login":"mganss","id":976344,"avatar_url":"https://avatars.githubusercontent.com/u/976344?v=3","gravatar_id":"","url":"https://api.github.com/users/mganss","html_url":"https://github.com/mganss","followers_url":"https://api.github.com/users/mganss/followers","following_url":"https://api.github.com/users/mganss/following{/other_user}","gists_url":"https://api.github.com/users/mganss/gists{/gist_id}","starred_url":"https://api.github.com/users/mganss/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mganss/subscriptions","organizations_url":"https://api.github.com/users/mganss/orgs","repos_url":"https://api.github.com/users/mganss/repos","events_url":"https://api.github.com/users/mganss/events{/privacy}","received_events_url":"https://api.github.com/users/mganss/received_events","type":"User","site_admin":false},"created_at":"2015-08-08T19:36:56Z","updated_at":"2015-08-08T19:36:56Z","body":"@Jawvig RFC 2368 was superseded by [RFC 6068](https://tools.ietf.org/html/rfc6068) which allows unencoded commas:\r\n```\r\nmailtoURI    = \"mailto:\" [ to ] [ hfields ]\r\nto           = addr-spec *(\",\" addr-spec )\r\n...\r\n```\r\nIn .NET 4.5 and above no exception is thrown because `Uri.TryCreate()` returns false and the URI is stripped. But of course this means that `System.Uri` is currently not compliant with RFC 6068 and Microsoft doesn't seem to have the intention to fix it soon: https://connect.microsoft.com/VisualStudio/feedback/details/794758/system-uri-incorrectly-rejects-mailto-uris\r\n\r\nI agree that the best way to deal with this issue is to catch the exception and strip the URI although it's legal. If someone insisted on keeping these kinds of URIs, they'd have to handle `RemovingAttribute` and check the URI themselves.\r\n\r\n@304NotModified Thanks :smile: "}}