# Markdown javascript: URL Injection

`.md` does not sanitize dangerous URL schemes in markdown links.

## Example

```markdown
[click me](javascript:alert(1))
```

Produces:

```html
<a href="javascript:alert(1)">click me</a>
```

Clicking executes the JavaScript.

## Why Current Design Doesn't Cover This

`.md` escapes raw HTML by intercepting `Event::Html` and `Event::InlineHtml`.
Markdown links emit structured events (`Event::Start(Tag::Link {...})`), not
HTML events—the URL passes through as data.

## Potential Fixes

1. **Intercept link events** - check `dest_url` for dangerous schemes
   (`javascript:`, `data:`, `vbscript:`)
2. **Allowlist schemes** - only permit `http:`, `https:`, `mailto:`, relative
   paths
3. **Rely on CSP** - Content-Security-Policy headers block inline script
   execution

## Tradeoffs

- Blocklists are fragile (many schemes, encoding tricks)
- Allowlists break legitimate use cases (custom protocols, bookmarklets)
- CSP is the modern defense but requires deployment configuration
