Guillaume Weghsteen d9efa1b0d7 feat(core): change the URL sanitization to only block javascript: URLs (#49659) ...

In modern browsers, the 'javascript:' URL scheme is the only scheme that
can execute JavaScript when passed in a navigation URL context (e.g.
`a.href` value). Validate URL shemes to only contain characters allowed
in the URL specification ([a-zA-Z-+.]), and that are not javascript
(case insensitive). This is not a breaking change. The URL sanitization
is loosen.

PR Close #49659

2023-04-04 15:01:14 -07:00

..

html_sanitizer_spec.ts

refactor(common): drop unnecessary srcset sanitization (#47302)

2022-09-09 14:27:16 -07:00

sanitization_spec.ts

docs: extract XSS security doc URL into a constant (#48082)

2022-11-17 13:21:16 -08:00

url_sanitizer_spec.ts

feat(core): change the URL sanitization to only block javascript: URLs (#49659)

2023-04-04 15:01:14 -07:00