XSS: Bypass of the Renderer's link security check

[qll]

>>> mistune.markdown('[text](javascript:alert`1`)')
'<p><a href="javascript&colon;alert`1`">text</a></p>\n'

The code actually checks for javascript:, wheras the browser happily first decodes entities and then executes the payload. Furthermore, there are lots of other ways to bypass this.

• In Firefox, you could use data:text/html,<script>alert1</script> as data-URIs inherit the document's context (and, thus, cookies etc).
• In old Internet Explorer versions, you could use vbscript-URIs
• There are some characters which can be put in front of javascript-URIs (but are very browser-dependant), so that the startswith check fails.
• I'm sure there are other protocol handlers which can do harm to unsuspecting users.

In general, I would advise against such a blacklist approach. I will attempt to create a good pull request for this soon.

[lepture]

Great

[lepture]

You fixed it.