JavaScript URLs allowed by the Sanitizer

1

1

1

1

function checkSanitizer(html) {0x0D
   document.body.setHTML(html);0x0D
   return document.body.querySelector('a').protocol === 'javascript:'0x0D
}

checkSanitizer('<a href="&#$[i];javascript:foo">test</a>') && log[i];0x0D
checkSanitizer('<a href="java&#$[i];script:foo">test</a>') && log[i];0x0D
checkSanitizer('<a href="javascript&#$[i];:foo">test</a>') && log[i];