Markdown parser, done right. 100% CommonMark support, extensions, syntax plugins & high speed
https://markdown-it.github.io/
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
79 lines
1.2 KiB
79 lines
1.2 KiB
.
|
|
[normal link](javascript)
|
|
.
|
|
<p><a href="javascript">normal link</a></p>
|
|
.
|
|
|
|
|
|
|
|
Should not allow some protocols in links and images
|
|
|
|
.
|
|
[xss link](javascript:alert(1))
|
|
|
|
[xss link](JAVASCRIPT:alert(1))
|
|
|
|
[xss link](vbscript:alert(1))
|
|
|
|
[xss link](VBSCRIPT:alert(1))
|
|
|
|
[xss link](file:///123)
|
|
.
|
|
<p>[xss link](javascript:alert(1))</p>
|
|
<p>[xss link](JAVASCRIPT:alert(1))</p>
|
|
<p>[xss link](vbscript:alert(1))</p>
|
|
<p>[xss link](VBSCRIPT:alert(1))</p>
|
|
<p>[xss link](file:///123)</p>
|
|
.
|
|
|
|
|
|
.
|
|
[xss link]("><script>alert("xss")</script>)
|
|
.
|
|
<p><a href="%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E">xss link</a></p>
|
|
.
|
|
|
|
.
|
|
[xss link](<javascript:alert(1)>)
|
|
.
|
|
<p>[xss link](<javascript:alert(1)>)</p>
|
|
.
|
|
|
|
.
|
|
[xss link](javascript:alert(1))
|
|
.
|
|
<p>[xss link](javascript:alert(1))</p>
|
|
.
|
|
|
|
|
|
Image parser use the same code base.
|
|
|
|
.
|
|
)
|
|
.
|
|
<p>)</p>
|
|
.
|
|
|
|
|
|
Autolinks
|
|
|
|
.
|
|
<javascript:alert(1)>
|
|
|
|
<javascript:alert(1)>
|
|
.
|
|
<p><javascript:alert(1)></p>
|
|
<p><javascript:alert(1)></p>
|
|
.
|
|
|
|
|
|
Linkifier
|
|
|
|
.
|
|
javascript:alert(1)
|
|
|
|
javascript:alert(1)
|
|
.
|
|
<p>javascript:alert(1)</p>
|
|
<p>javascript:alert(1)</p>
|
|
.
|
|
|