Shazzer logo

    HTML entities before JavaScript URL

    Safari logo 2

    Shows which HTML entities are allowed before the JavaScript protocol

    Created by: hackvertor

    Created on: Tuesday, June 25, 2024 at 4:42:13 PM

    Updated on: Monday, October 21, 2024 at 4:17:25 AM

    Vector type: JS

    Code used before fuzz:
    const div = document.createElement('div');
    Template used:
    div.innerHTML='<a href="$[data1]javascript:">test</a>';
div.querySelector('a').protocol === 'javascript:' && log('$[data1]')
    Your browser was detected as:
    Detecting... Detecting... Detecting... Detecting...

    Sample payloads

    div.innerHTML='<a href="&Tab;javascript:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('&Tab;')
    div.innerHTML='<a href="&NewLine;javascript:">test</a>';
div.querySelector('a').protocol === 'javascript:' && alert('&NewLine;')

    Fuzz results

    Safari logo
    Safari 17.5 mobile iOS 17.5.1

    Updated

    Tue Jun 25 2024
    Found 2 results
    Data
    &NewLine;
    Data
    &Tab;