Closed fr3akX closed 4 years ago
href attribute value has decoded html entities in output.
Example
String input = "" + "<a href=\"/index.php?action=1&order_id=1\">order</a>"; System.out.println(Sanitizers.LINKS.sanitize(input));
output
<a href="/index.php?action=1ℴ_id=1" rel="nofollow">order</a>
&order is decoded as ℴ, which renders invalid link
&order
ℴ
@fr3akX Hello. I think - and _ char may be treated in plain letters. What do you think?
-
_
href attribute value has decoded html entities in output.
Example
output
&order
is decoded asℴ
, which renders invalid link