Web Development
Bug Report
Stored XSS through Markdown javascript: links in user comments
Our comment system rendered Markdown and stripped script tags, yet a link with a javascript: URL survived into the page. We fixed it by sanitizing the rendered HTML with an allowlist of tags, attributes and URL schemes, and backed it with a strict Content-Security-Policy.