Sanitize http://Payload in url?

braintree / sanitize-url

MIT License

312 stars 35 forks source link

Sanitize http://Payload in url? #6

Closed george-norris-salesforce closed 5 years ago

george-norris-salesforce commented 5 years ago

var d = http://Payload: "><object data='data:text/html;base64,PHN2Zy9vbmxvYWQ9YWxlcnQoMSk+'>; sanitizeUrl(d); Would be nice if this resolved to about:blank too

crookedneighbor commented 5 years ago

Can you give more context (and docs) on the http://Payload: protocol? I'm familiar with data: and resource:, but payload: is a new one to me.

george-norris-salesforce commented 5 years ago

Closing. Ended up using valid-url package to test for valid url stings