v157 · sanitizer api · edge / failure modes
Escape artists
"Contains a javascript: URL" is decided by the URL parser, not by string matching — so JaVaScRiPt:, leading control characters, tab-split schemes, and HTML-entity spellings are all caught, while vbscript: and data: URLs are deliberately not this rule's business. This page builds one markup snippet per cell — every obfuscated spelling crossed with every navigation attribute the spec names — and runs each through the real sanitizer in your browser.
Probing…
The matrix
Call used: (probing)
Not run yet.
- stripped — attribute removed, element kept
- kept — attribute survived sanitization
- elem gone — the element itself was removed (so the attribute question is moot)
| URL spelling |
|---|
Specified outcome (labelled — nothing ran)
This browser has no Sanitizer API, so instead of a fake run: per the HTML Standard, with javascriptURLs not true, rows 1–5 (every spelling the URL parser resolves to the javascript: scheme — case-insensitive, after stripping leading C0 controls/space and interior tabs/newlines) are stripped from navigating and animating URL attributes, MathML href included; rows 6–8 (vbscript:, data:, https:) are not touched by this rule — other sanitizer rules (element and attribute allowlists) may still remove them.
what counts as a navigation attribute
The inner sanitize steps check three lists when javascriptURLs is not true: the built-in navigating URL attributes ((element, attribute) pairs like a href, area href, form action, input formaction, button formaction, and SVG's a href), MathML elements' href (null or XLink namespace), and the built-in animating URL attributes (SVG <animate> and friends). iframe src and img src are not in the navigation list — a javascript: URL there never navigates the top-level page; other sanitizer rules handle those elements.