I've got an app which allows users to customize the "thank you" message that is displayed to users when a form is submitted.
For the "thank you" message contents I've whitelisted allowable HTML tags and their corresponding attributes. One of the tags that I allow is an anchor tag and it's corresponding href
attribute, so that users can add links to their "thank you" messages.
I recently received a report from a pen-tester who claims that my thank-you form is susceptible to cross site scripting because it is possible for a user to execute JavaScript from the href
tag, as such:
<a href="javascript:alert()">Is this XSS?</a>
Any other attributes are stripped from the anchor tag.
Questions:
- Is this technically considered XSS?
- If so, how can I mitigate this "attack"?
From reading this question it appears that I could require the href
attribute to start with either an h
or a /
. Would that be sufficient?