Shazzer logo

Entities after protocol-relative URL

Chrome logo 18
Firefox logo 18
Edge logo 18
Safari logo 18

Tests which entities are allowed after a protocol-relative URL

hackvertor
Created byhackvertor
Created Apr 3, 2026
Updated Apr 3, 2026

Tweet
Detecting browser...
CategoryEntity Parsing
VisibilityPublic
TypeJS
CharsetUTF-8
$[data1] placeholderhtml_entities
Code used before fuzz:
const div = document.createElement('div')
Template used:
div.innerHTML='<a href="//$[data1]example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   log('$[data1]');0x0D
}

Sample payloads

div.innerHTML='<a href="//&af;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&af;');0x0D
}
div.innerHTML='<a href="//&ApplyFunction;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&ApplyFunction;');0x0D
}
div.innerHTML='<a href="//&bsol;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&bsol;');0x0D
}
div.innerHTML='<a href="//&commat;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&commat;');0x0D
}
div.innerHTML='<a href="//&ic;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&ic;');0x0D
}
div.innerHTML='<a href="//&InvisibleComma;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&InvisibleComma;');0x0D
}
div.innerHTML='<a href="//&InvisibleTimes;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&InvisibleTimes;');0x0D
}
div.innerHTML='<a href="//&it;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&it;');0x0D
}
div.innerHTML='<a href="//&NegativeMediumSpace;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&NegativeMediumSpace;');0x0D
}
div.innerHTML='<a href="//&NegativeThickSpace;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&NegativeThickSpace;');0x0D
}
div.innerHTML='<a href="//&NegativeThinSpace;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&NegativeThinSpace;');0x0D
}
div.innerHTML='<a href="//&NegativeVeryThinSpace;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&NegativeVeryThinSpace;');0x0D
}
div.innerHTML='<a href="//&NewLine;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&NewLine;');0x0D
}
div.innerHTML='<a href="//&NoBreak;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&NoBreak;');0x0D
}
div.innerHTML='<a href="//&shy;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&shy;');0x0D
}
div.innerHTML='<a href="//&sol;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&sol;');0x0D
}
div.innerHTML='<a href="//&Tab;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&Tab;');0x0D
}
div.innerHTML='<a href="//&ZeroWidthSpace;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&ZeroWidthSpace;');0x0D
}
div.innerHTML='<a href="//&zwj;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&zwj;');0x0D
}
div.innerHTML='<a href="//&zwnj;example.com">';0x0D
if(div.querySelector('a').host === 'example.com') {0x0D
   alert('&zwnj;');0x0D
}

Fuzz results

Chrome logo
Chrome 147.0.0.0 desktop macOS 10.15.7
Updated5 Apr 2026
Found 18 results
Loading...
Chrome logo
Chrome 146.0.0.0 desktop Windows NT 10.0older version
Updated4 Apr 2026
Found 18 results
Loading...
Chrome logo
Chrome 146.0.0.0 mobile Android 10older version
Updated4 Apr 2026
Found 18 results
Loading...
Chrome logo
Chrome 146.0.0.0 desktop Linux Unknownolder version
Updated8 Apr 2026
Found 18 results
Loading...
Chrome logo
Chrome 104.0.0.0 mobile Android 13older version
Updated4 Apr 2026
Found 14 results
Loading...
Firefox logo
Firefox 150.0 desktop Windows NT 10.0
Updated5 Apr 2026
Found 18 results
Loading...
Firefox logo
Firefox 149.0 desktop macOS 10.15older version
Updated3 Apr 2026
Found 18 results
Loading...
Firefox logo
Firefox 145.0 desktop Linux Unknownolder version
Updated5 Apr 2026
Found 18 results
Loading...
Edge logo
Microsoft Edge 146.0.0.0 desktop Windows NT 10.0
Updated6 Apr 2026
Found 18 results
Loading...
Safari logo
Safari 26.4 mobile iOS 18.7
Updated3 Apr 2026
Found 18 results
Loading...
Safari logo
Safari 26.3.1 desktop macOS 10.15.7older version
Updated6 Apr 2026
Found 18 results
Loading...
Safari logo
Safari 26.0 mobile iOS 18.6older version
Updated4 Apr 2026
Found 18 results
Loading...