Is allowing self contained xss on anchor elements safe (just blacklist javascript: properly)?

Question

I know this is not a good idea for other elements and attributes, but for<a href=>it seems javascript: is the only scheme which can lead to true xss.

So is it safe to allow this ? The only thing I coudn’t figure is if a flash file loaded with a data: ᴜʀɪ would keep the same origin of the site.

Answer 1

Yes, allowing all protocols on the href element of anchor tags is perfectly safe as long as the javascript: scheme is properly blacklisted. There are no plugins that would allow to escape this behaviour.