JavaScript URLs allowed by the Sanitizer

1

1

1

1

function checkSanitizer(html) {
   document.body.setHTML(html);
   return document.body.querySelector('a').protocol === 'javascript:'
}

checkSanitizer('<a href="&#$[i];javascript:foo">test</a>') && log[i];
checkSanitizer('<a href="java&#$[i];script:foo">test</a>') && log[i];
checkSanitizer('<a href="javascript&#$[i];:foo">test</a>') && log[i];