https://twitter.com/IAmMandatory/status/915439417665261568
We've added a blacklist of url schemes and CSP. I'd like to have a whitelist if I can find one with all known-good schemes we'd like to be able to support. Know of one?
But your 'testing' might get you call from the police. I would be more careful posting xss on live sites.
We've added a blacklist of url schemes and CSP. I'd like to have a whitelist if I can find one with all known-good schemes we'd like to be able to support. Know of one?