Currently the code rejects links that .startswith("javascript:"). This is blacklisting. Blacklisting is bad.
We'll want to whitelist only things like http://, https://, and data:// with specific mimetypes.
Consider: <a href="javaScript:alert('gotcha')">click here</a>.
Currently the code rejects links that
.startswith("javascript:"). This is blacklisting. Blacklisting is bad.We'll want to whitelist only things like
http://,https://, anddata://with specific mimetypes.Consider:
<a href="javaScript:alert('gotcha')">click here</a>.