Further XSS fixes in link attrs (#703) - #705

Open

Crozzers wants to merge 10 commits into

trentm:masterfrom

Crozzers:further-xss-fixes

Commits on May 14, 2026

Fix XSS fromn HTML encoded colons in hrefs
Crozzers
committed
3b96ec1
Fix XSS from making javascript: hrefs look like domains with ports
Crozzers
committed
a11ce82
Fix onerror XSS in image title attr
Crozzers
committed
82b4482

Commits on May 23, 2026

Fix incomplete recursive unhashing of spans
Crozzers
committed
456f8a9
Update github actions versions
Crozzers
committed
c173c12

Commits on May 24, 2026

Fix smuggling XSS into link def URLs
Crozzers
committed
b0dd0b3

Commits on Jun 13, 2026

Fix HTML block hashing messing up if open/close tags not at start of line
Crozzers
committed
c7a75f6

Commits on Jun 14, 2026

Fix links being processed within autolink syntax
Crozzers
committed
e7b0ba1

Commits on Jun 20, 2026

Fix tag balance checkers not accounting for void tags
Crozzers
committed
21eb34b

Commits on Jun 26, 2026

Loosen link-within-autolink check for if link starts OR ends inside autolink
Crozzers
committed
2f0cf2c