Originally I had only concentrated the link validation on the elements that were safe to link. However people do want to allow some unsafe elements and yet still have the benefits of link validation and sanitization, i.e. allow iframe
but still have the src
safely validated... these changes allow that.
Additionally I have added tests showing how AllowSchemesWithCustomPolicy
can be used to globally allow only links to certain domains, and a test that shows how to apply the AllowAttributes().Matching().OnElements
to only allow a given domain on specific elements (i.e. only allow an iframe
if is is a YouTube embed).