Escape all attributes with javascript:

qq99 / echoplexus

Socket.io powered chat, JavaScript REPL, whiteboard, and WebRTC calls

Other

394 stars 53 forks source link

Escape all attributes with javascript: #210

Closed qq99 closed 10 years ago

qq99 commented 10 years ago

https://github.com/qq99/echoplexus/blob/master/src/client/utility.js.coffee#L22

Elements with attributes with content javascript:somefunc() probably still get through the HTMLSanitizer, so this could be an issue with rogue webhooks