javascript URLs just work

Little demonstration of how javascript scheme URLs just... run code.

by David Iglesias

HTML

<li><a href="javascript:alert('1')">XSS!</a>
<li><a id="xss" class="fakelink">Another!</a>

CSS

.fakelink {
  color: blue;
  text-decoration: underline;
  cursor: pointer;
}

JavaScript

xss.addEventListener('click', (event) => {
  window.open("javascript:alert('1')");
});