Michael Rooney

Hi there, thanks for the amazing filter! I've been doing a lot of Ritual lately and noticed that on Uber-Strict, a bunch of valuable div card stacks are often hidden....

encodeURI the href to prevent XSS attacks via ending the quote and adding arbitrary scripts in onmouseover/onclick

1

Without this fix, a link such as: http://xss.com/"onmouseover=alert('XSS');// is a vulnerability. I don't know how to minify the code so it would need a regen of the minified code, but...