Home | History | Annotate | Download | only in safe_mode 
      1 These links should be unsafe and not allowed in safe_mode
      2 
      3 [link](javascript:alert%28'Hello%20world!'%29)
      4 [link](vbscript:msgbox%28%22Hello%20world!%22%29)
      5 [link](livescript:alert%28'Hello%20world!'%29)
      6 [link](mocha:[code])
      7 [link](jAvAsCrIpT:alert%28'Hello%20world!'%29)
      8 [link](ja vas cr ipt:alert%28'Hello%20world!'%29)
      9 [link](ja vas cr ipt:alert%28'Hello%20world!'%29)
     10 [link](ja vas cr ipt:alert%28'Hello%20world!'%29)
     11 [link](ja%09 %0Avas cr
ipt:alert%28'Hello%20world!'%29)
     12 [link](ja%20vas%20cr%20ipt:alert%28'Hello%20world!'%29)
     13 [link](live%20script:alert%28'Hello%20world!'%29)
     14 
     15 ![img](javascript:alert%29'XSS'%29)
     16 [ref][]
     17 ![imgref][]
     18 
     19 [ref]: javascript:alert%29'XSS'%29
     20 [imgref]: javascript:alert%29'XSS'%29
     21 
     22 These should work regardless:
     23 
     24 [relative](relative/url.html)
     25 [email](mailto:foo (a] bar.com)
     26 [news scheme](news:some.news.group.com)
     27 [http link](http://example.com)
     28