1 Topic by roelvd (edited by roelvd 2023-08-03 05:08:07)

  • roelvd
  • Member
  • Offline

Topic: formaction is allowed in safe mode

The following code is not caught by the safe mode of HtmLawed:

<button form="test" formaction="javascript:alert(123489574)">Click</button>' does not contain "formaction


But, if you click on the following code, it will execute the javascript.


I would suggest to disallow the formaction attribute in safe mode.


Let me know if it would be helpful for me to contribute such a change.

2 Reply by patnaik

  • patnaik
  • Administrator
  • Offline

Re: formaction is allowed in safe mode

Thank you for pointing this important issue. It is now fixed in the new release, version 1.2.15.

3 Reply by roelvd

  • roelvd
  • Member
  • Offline

Re: formaction is allowed in safe mode

Awesome! Thanks a lot for the great work :).