Markdown parser, done right. 100% CommonMark support, extensions, syntax plugins & high speed
https://markdown-it.github.io/
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
56 lines
851 B
56 lines
851 B
.
|
|
[normal link](javascript)
|
|
.
|
|
<p><a href="javascript">normal link</a></p>
|
|
.
|
|
|
|
|
|
|
|
Should not allow some protocols in links and images
|
|
|
|
.
|
|
[xss link](javascript:alert(1))
|
|
.
|
|
<p>[xss link](javascript:alert(1))</p>
|
|
.
|
|
|
|
.
|
|
[xss link](JAVASCRIPT:alert(1))
|
|
.
|
|
<p>[xss link](JAVASCRIPT:alert(1))</p>
|
|
.
|
|
|
|
.
|
|
[xss link](vbscript:alert(1))
|
|
.
|
|
<p>[xss link](vbscript:alert(1))</p>
|
|
.
|
|
|
|
.
|
|
[xss link](VBSCRIPT:alert(1))
|
|
.
|
|
<p>[xss link](VBSCRIPT:alert(1))</p>
|
|
.
|
|
|
|
.
|
|
[xss link](file:///123)
|
|
.
|
|
<p>[xss link](file:///123)</p>
|
|
.
|
|
|
|
|
|
.
|
|
[xss link]("><script>alert("xss")</script>)
|
|
.
|
|
<p><a href="&#34;&#62;&#60;script&#62;alert&#40;&#34;xss&#34;&#41;&#60;/script&#62;">xss link</a></p>
|
|
.
|
|
|
|
|
|
Image parser use the same code base.
|
|
|
|
.
|
|
)
|
|
.
|
|
<p>)</p>
|
|
.
|
|
|
|
|