Javascript 如何解析带有前导不可打印控制字符的URL？
我将在的上下文中研究Perl（和）中的几个URL解析器。我想解决的问题是，在某些情况下，我希望能够剥离URL。例如，在过滤HTML时，我可能希望允许相对URL，但不允许JavaScript 我遇到了以下问题：Javascript 如何解析带有前导不可打印控制字符的URL？,javascript,perl,url,Javascript,Perl,Url,我将在的上下文中研究Perl（和）中的几个URL解析器。我想解决的问题是，在某些情况下，我希望能够剥离URL。例如，在过滤HTML时，我可能希望允许相对URL，但不允许JavaScript 我遇到了以下问题： #!/usr/bin/env perl use strict; use warnings; use feature qw( say ); use Mojo::URL (); my $js_url = 'javascript:alert(1);'; my $mojo = Mojo::
#!/usr/bin/env perl
use strict;
use warnings;
use feature qw( say );
use Mojo::URL ();
my $js_url = 'javascript:alert(1);';
my $mojo = Mojo::URL->new($js_url);
say 'scheme: ' . $mojo->scheme . " in $js_url";
for my $i ( 1 .. 8, 14 .. 31 ) {
my $bad_url = "&#$i;" . $js_url;
my $mojo = Mojo::URL->new($bad_url);
say $mojo->scheme ? 'scheme is ' . $mojo->scheme : 'no scheme found in ' . $bad_url;
}
scheme: javascript in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
no scheme found in javascript:alert(1);
href<a href="javascript:alert(1);">1</a>
<a href="javascript:alert(1);">2</a>
<a href="javascript:alert(1);">3</a>
<a href="javascript:alert(1);">4</a>
<a href="javascript:alert(1);">5</a>
<a href="javascript:alert(1);">6</a>
<a href="javascript:alert(1);">7</a>
<a href="javascript:alert(1);">8</a>
<a href="javascript:alert(1);">14</a>
<a href="javascript:alert(1);">15</a>
<a href="javascript:alert(1);">16</a>
<a href="javascript:alert(1);">17</a>
<a href="javascript:alert(1);">18</a>
<a href="javascript:alert(1);">19</a>
<a href="javascript:alert(1);">20</a>
<a href="javascript:alert(1);">21</a>
<a href="javascript:alert(1);">22</a>
<a href="javascript:alert(1);">23</a>
<a href="javascript:alert(1);">24</a>
<a href="javascript:alert(1);">25</a>
<a href="javascript:alert(1);">26</a>
<a href="javascript:alert(1);">27</a>
<a href="javascript:alert(1);">28</a>
<a href="javascript:alert(1);">29</a>
<a href="javascript:alert(1);">30</a>
<a href="javascript:alert(1);">31</a>
Mojo:：URLURI这是怎么回事？解析器和浏览器是否都正常工作？在解析URL之前，是否由我来去除不可打印的控制字符？至少表明这些URL是“无效”的URL，不幸的是，似乎用户代理会清除它们。对于清理/剥离HTML，我想您应该遵循UAs实现的内容，而不是规范中所说的内容……除此之外，您将普通URL与HTML上下文中编码的URL混为一谈。您添加的字符（即
；\x01；