urlBearingAttributes constant

Set<String> const urlBearingAttributes

Attribute names whose value is interpreted as a URL by the browser / renderer. Every one must be passed through isSafeUrl so that javascript:, file:, data: SVG, etc. cannot slip through via a non-href/src channel.

Historically the sanitizer only checked href and src, which left <video poster="javascript:...">, <object data="...">, <blockquote cite="...">, and similar attributes as XSS bypass vectors.

Implementation

static const Set<String> urlBearingAttributes = {
  'href',
  'src',
  'poster',
  'data',
  'cite',
  'background',
  'longdesc',
  'usemap',
  'manifest',
  'xlink:href',
  'formaction',
  'action',
  'icon',
  'srcset',
};