}
+ private boolean checkAttrValue(String attrValue) {
+ if (attrValue.toLowerCase().startsWith("javascript:")){
+ return false;
+ }
+ return true;
+
+ }
+
+
private boolean checkNode(String nodeName) {
List languages = StringRoutines.splitString(MirGlobal.config().getString("Localizer.HTML.Whitelist"), ";");
for (int i = 0; i < attrs.getLength(); i++) {
String attrName = attrs.item(i).getNodeName();
- if (checkAttr(attrName)) {
+ String attrValue = attrs.item(i).getNodeValue();
+ if (checkAttr(attrName) && checkAttrValue(attrValue)) {
out.write(' ');
out.write(attrs.item(i).getNodeName());
out.write("=\"");
-
+
out.write(attrs.item(i).getNodeValue());
out.write('"');
}