'JS Prevent XSS but allow HTML URL
I have an Angular 1 app, with a form input used for creating site notifications.
A user can enter a full url http://example.com or they can also enter a path within the application /foo/barboo
However, an attacker could also enter javascript:alert(1);// and when the notification link is pressed, the JS will fire.
Is it possible to encode this input but still allow url's to be treated as such?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|