1be50ed28bFastSanitize checks the scheme with URI.parse/1, which finds none in java<TAB>script:alert(1). Browsers remove tabs and newlines and leading control characters first and run it as a javascript: link. The scrubbers now use Pleroma.HTML.URIAttributes, which normalizes the URL the same way before the scheme check. |
||
|---|---|---|
| .. | ||
| config | ||
| credo/check/consistency | ||
| fixtures | ||
| instance_static | ||
| mix | ||
| pleroma | ||
| support | ||
| test_helper.exs | ||