Microsoft Anti XSS Library encoding ampersands?

I am currently using the Microsoft AntiXSS library and using the GetSafeHtmlFragment method as follows:

public static string 开发者_如何学CSanitizeHtml(this string s)
{
    return Sanitizer.GetSafeHtmlFragment(s);
}

However, if I pass in a string like this:

black & white

... it is encoding the ampersand so it becomes:

black & white

Is this normal behaviour for this library? Is there a way of preventing it from encoding this character?

I don't think this is the best solution. If you use HTML.Raw() then you are leaving yourself vulnerable to XSS attacks unless you can be absolutely sure that the string is safe all the time and for all uses of HTML.Raw().

Is this normal behaviour for this library?

Yes, it fixes your HTML since you are using GetSafeHtmlFragment. Otherwise you would have ended up with invalid HTML fragment. In HTML the & character has special meaning. I don't think this behavior could be modified.