Characters allowed before the JavaScript protocol colon

This tests for chars allowed before the colon in a Javascript uri format.

Created Mar 3, 2025

Updated May 28, 2025

Detecting browser...

CategoryURL Handling

VisibilityPublic

TypeXSS

CharsetUTF-8

Code used before fuzz:

<script>window.onerror=x=>true;</script>0x0D
<base href="https://example.com" />

Template used:

<a href="javascript$[chr]:" id=x></a>

Code used after fuzz:

x.protocol === 'javascript:' && log($[i])

Sample payloads

<a href="javascript0x09:" id=x></a>

<a href="javascript
:" id=x></a>

<a href="javascript0x0D:" id=x></a>

<a href="javascript::" id=x></a>