SA-2026-002: Links built from captured data had no scheme check

What it is

Source URLs, leads and other links from data were HTML-escaped but not checked for their scheme, so a javascript: or data: URL would have become a clickable link.

What an attacker could do

One click on a poisoned "original" link would run script on the site. No such URL was in the data.

How: A source row (from a captured page or a tip) carries url: "javascript:...". The build writes it into href.

Root cause

Escaping was treated as sufficient for URLs; it stops attribute breakout, not dangerous schemes.

What contributed

• URLs are the one field where escaping and validation are different jobs.

What was not in place

A URL allow-list at the point where data becomes an href.

The fix

U() lets through only http(s), mailto and relative URLs; everything else becomes "#".

What prevents it now

The gate fails on javascript:, vbscript: and data:text/html in href, src and action; the CSP blocks javascript: URLs.