XSS: Javascript execution through links

Posting this:

[Just Regular Link](javascript:alert(1))

Renders

A link which will show alert on click. Should this be considered an XSS vulnerability and mitigated by library itself or by the users by creating a custom parser?

[vsch]

@iamareebjamal, I think an option is needed to filter out some URI formats for links. I will add it. That way custom link resolver will only be needed for special cases.

[vsch]

@bvn13, it is enabled by default but if you want to change the RegEx used for suppressing links you can add .set(HtmlRenderer.SUPPRESSED_LINKS, "your reg ex here") to your Parser/Renderer build options.

See the flexmark-java-samples module directory for examples.