FastSanitize checks the scheme with URI.parse/1, which finds none in java<TAB>script:alert(1). Browsers remove tabs and newlines and leading control characters first and run it as a javascript: link. The scrubbers now use Pleroma.HTML.URIAttributes, which normalizes the URL the same way before the scheme check. |
||
|---|---|---|
| .. | ||
| gettext | ||
| repo | ||
| scrubbers | ||
| static | ||
| templates | ||