https://bugzilla.redhat.com/show_bug.cgi?id=2127078
--- Doc Text *updated* by Sandipan Roy <saroy(a)redhat.com> ---
jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site
scripting (XSS) safety. jsoup may incorrectly sanitize HTML including `javascript:` URL
expressions, which could allow XSS attacks when a reader subsequently clicks that link. If
the non-default `SafeList.preserveRelativeLinks` option is enabled, HTML including
`javascript:` URLs that have been crafted with control characters will not be sanitized.
If the site that this HTML is published on does not set a Content Security Policy, an XSS
attack is then possible.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2127078