I wonder if
src attributes on
<img> tags are always safe w.r.t. XSS attacks, if they start with
For example, is it possible to append
src attribute in some manner, to execute code?
Disregarding whether or not the destination page is e.g. a pishing site, or the
<img src=...> triggers a terribly troublesome HTTP GET request.
Background: I'm processing text with markdown, and then I sanitize the resulting HTML (using Google Caja's JsHtmlSanitizer). Some sample code in Google Caja assumes all
srcs that start with
https:// are safe -- I wonder if it's safe to use that sample code.