AntiXSS in ASP.Net Core : <p><a href="https://wpl.codeplex.com/" rel="noreferrer">Microsoft Web Protection Library (AntiXSS)</a> has reached End of Life. The page states "In .NET 4.0 a version of AntiXSS was included in the framework and could be enabled via configuration. In ASP.NET v5 a white list based encoder will be the only encoder."</p>

<p>I have a classic cross site scripting scenario: An ASP.Net Core solution where users can edit text using a WYSIWYG html-editor. The result is displayed for others to see. This means that if users inject a JavaScript into the data they submit when saving the text this code could execute when others visits the page. </p>

<p>I want to be able to whitelist certain HTML-codes (safe ones), but strip out bad codes.</p>

<p>How do I do this? I can't find any methods in ASP.Net Core RC2 to help me. Where is this white list encoder? How do I invoke it? For example I would need to clean output being returned via JSON WebAPI.</p>
