I found a markup processor that allows users to include arbitrary links, as long as they contain a "netloc" (
// after the first
:). Due to the myriad of exploitable protocol handlers, this is certainly a bad idea. But does it allow XSS on a system without vulnerable protocol handlers?
All browsers I tested (Chrome 22, FF 18, IE 9, Opera 12) do not show anything when pointed to
alert a new line) doesn't work either.