I wonder if href and src attributes on <a> and <img> tags are always safe w.r.t. XSS attacks, if they start with http:// or https://.

For example, is it possible to append javascript: ... to the href and src attribute in some manner, to execute code?

Disregarding whether or not the destination page is e.g. a pishing site, or the <img src=...> triggers a terribly troublesome HTTP GET request.

Background: I'm processing text with markdown, and then I sanitize the resulting HTML (using Google Caja's JsHtmlSanitizer). Some sample code in Google Caja assumes all hrefs and srcs that start with http:// or https:// are safe -- I wonder if it's safe to use that sample code.

Kind regards,

  • 1
    You shouldn't be using only an HTML sanitizer. They can be easily bypassed and should only be used for convenience when used in conjunction with a server side solution. HTML Purifier is a good example of that.
    – John Conde
    Commented Mar 30, 2011 at 13:38
  • Actually, I run JsHtmlSanitizer on both the client and server. On the server I using the Rhino JavaScript engine. I just read about HTML Purifier and I got the impression that running JsHtmlSanitizer on the server would do roughly the same thing, as HTML Purifier? Except for the fact that JsHtmlSanitizer only sanitizes, doesn't purify. (Thanks for the tip :-))
    – KajMagnus
    Commented Mar 30, 2011 at 14:35

1 Answer 1


Allowing only the http(s) protocol prevents running javascript, but they can still be used for malicious purposes. Consider the following:

<img src="http://your.website.com/changepassword.php?newpass=hacked123" />

Allowing users to embed content from external websites is always risky, but sometimes inevitable. Making sure your scripts are well protected against XSS like the one above will make your site more solid, if not 100% hacker proof.

EDIT: Here's a pretty comprehensive XSS cheat sheet, though a bit aged. One important point taken from the cheat sheet that I forgot to mention is that you should also escape quotes and/or > signs to prevent URLs such as http://legiturl.com"><script src="http://mal.icio.us/attack.js">.

  • "Allowing only the http(s) protocol prevents running javascript" - do you have a source for that?
    – Jo Liss
    Commented Jun 20, 2012 at 12:30
  • @JoLiss: Sorry for the poor choice of words, I meant that allowing only the http(s) protocol in the URL prevents embedding javascript in the URL itself. Commented Jun 27, 2012 at 18:22
  • Right, that's what I understood. It seems very reasonable, but do you have an actual source for that? I wouldn't want to filter by /^https?:\/\//, only to discover later that there's some obscure URI feature I didn't know about.
    – Jo Liss
    Commented Jun 27, 2012 at 20:37
  • @JoLiss: I found a quite good source and edited it into my post. It's mainly for older browsers but many of the points are still valid. Commented Jun 28, 2012 at 14:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.