Fuzzing for Max sanitized input (simplified)

⚠ Browser differences

33

33

33

1

<script>0x0D
window.onerror=x=>true;0x0D
</script>0x0D
<base href="https://example.com" />

<a id=x></a>

const mw = /^(?!javascript:)/i;0x0D
function nu(e) {0x0D
    return (e = String(e)).match(mw) ? e : "unsafe:" + e0x0D
}0x0D
0x0D
const t = nu(`${String.fromCodePoint($[i])}javascript:alert(1)`);0x0D
x.href = t0x0D
x.protocol === 'javascript:' && log($[i])