Are all anchor tag href attributes considered XSS vulnerabilities?

Question

I've got an app which allows users to customize the "thank you" message that is displayed to users when a form is submitted.

For the "thank you" message contents I've whitelisted allowable HTML tags and their corresponding attributes. One of the tags that I allow is an anchor tag and it's corresponding href attribute, so that users can add links to their "thank you" messages.

I recently received a report from a pen-tester who claims that my thank-you form is susceptible to cross site scripting because it is possible for a user to execute JavaScript from the href tag, as such:

<a href="javascript:alert()">Is this XSS?</a>

Any other attributes are stripped from the anchor tag.

Questions:

1. Is this technically considered XSS?
2. If so, how can I mitigate this "attack"?

From reading this question it appears that I could require the href attribute to start with either an h or a /. Would that be sufficient?

Answer 1

Is this technically considered XSS

Absolutely.When the user click's the tag the javascript will get executed in the context of the domain.So it is a legitimate XSS.

If so, how can I mitigate this "attack"?

OWASP XSS prevention cheatsheet is an excellent resource for such questions.

They state that

Do not encode complete or relative URL's with URL encoding! If untrusted input is meant to be placed into href, src or other URL-based attributes, it should be validated to make sure it does not point to an unexpected protocol, especially javascript links. URL's should then be encoded based on the context of display like any other piece of data. For example, user driven URL's in HREF links should be attribute encoded.