HTML Purifier: Removing an element conditionally based on its attributes
- by pinkgothic
As per the HTML Purifier smoketest, 'malformed' URIs are occasionally discarded to leave behind an attribute-less anchor tag, e.g.
<a href="javascript:document.location='http://www.google.com/'">XSS</a> becomes <a>XSS</a>
...as well as occasionally being stripped down to the protocol, e.g.
<a…