Skip to content

Z205: FORBIDDEN_SCHEME

  • Severity: Error

    Penalty: 0.0 points | Category: general

  • Remediation & Opt-In

    Auto-Fixable: No | Opt-In: No

Rationale

Non-suppressible security violation emitted when a link uses a forbidden URI scheme (javascript: or data:), representing a potential XSS security risk.

How to Fix

Remove javascript: or data: schemes from links and replace them with standard HTTP/HTTPS URLs or internal relative links.

Reference

See the Finding Codes Index for finding code details.