Tokenizing...

Entities before protocol-relative URL

Tests which entities are allowed before a protocol-relative URL

Shazzer Master

Created byhackvertor

Created Apr 2, 2026

Updated Sep 5, 2026

Unable to render tweet button

Detecting browser...

CategoryEntity Parsing

VisibilityPublic

TypeJS

CharsetUTF-8

$[data1] placeholderhtml_entities

Code used before fuzz:

const div = document.createElement('div')

Template used:

div.innerHTML='<a href="$[data1]//example.com">';
if(div.querySelector('a').host === 'example.com') {
   log('$[data1]');
}

Sample payloads

div.innerHTML='<a href="&bsol;//example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&bsol;');
}

div.innerHTML='<a href="&NewLine;//example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&NewLine;');
}

div.innerHTML='<a href="&sol;//example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&sol;');
}

div.innerHTML='<a href="&Tab;//example.com">';
if(div.querySelector('a').host === 'example.com') {
   alert('&Tab;');
}