Simon Willison’s Weblog

Javascript protocol fuzz results. If your HTML sanitizer uses blacklisting rather than whitelisting here are a few more weird ways of injecting javascript: in to a link that you need to worry about—but you should really switch to whitelisting http:// and https:// instead.

# 30th June 2008, 3:57 pm / sanitization, html, blacklisting, whitelisting, javascript, fuzztesting, firefox, security