https://bugzilla.redhat.com/show_bug.cgi?id=2127078
--- Doc Text *updated* by RaTasha Tillery-Smith <rtillery(a)redhat.com> ---
A flaw was found in jsoup, a Java HTML parser built for HTML editing, cleaning, scraping,
and Cross-site scripting (XSS) safety. An issue in jsoup may incorrectly sanitize HTML,
including `javascript:` URL expressions, which could allow XSS attacks when a reader
subsequently clicks that link. If the non-default `SafeList.preserveRelativeLinks` option
is enabled, HTML, including `javascript:` URLs crafted with control characters, will not
be sanitized. If the site that this HTML is published on does not set a Content Security
Policy, an XSS attack is possible.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2127078