Search code examples
htmlhyperlinkwhitelist

link shenanigans?

If using an HTML whitelist and HTMLPurifier, are there any shenanigans a malicious user can execute if <a></a> is allowed?

For atmosphere:

Shenanigans!

Solution

  • Not if you only allow the href attribute and don't allow the javascript: pseudo protocol.