I've got an app which allows users to customize the "thank you" message that is displayed to users when a form is submitted.
For the "thank you" message contents I've whitelisted allowable HTML tags and their corresponding attributes. One of the tags that I allow is an anchor tag and it's corresponding
href attribute, so that users can add links to their "thank you" messages.
href tag, as such:
Any other attributes are stripped from the anchor tag.
- Is this technically considered XSS?
- If so, how can I mitigate this "attack"?
From reading this question it appears that I could require the
href attribute to start with either an
h or a
/. Would that be sufficient?