Characters allowed in colon entity

This vector shows if a character is allowed in an entity. Firefox did that in the past

Created on: Thursday, September 19, 2024 at 11:07:03 AM

Updated on: Thursday, September 19, 2024 at 11:07:03 AM

Vector type: XSS

<a href="javascript&colo$[chr]n;abcd" id="x">f</a>

try{
if(x.protocol == "javascript:")log($[i])
}catch(e){}