Why is the use of TAB (%09) characters in the middle a ‘JavaScript:’ URL valid?

Some context: I was assinged on a pentest and found an application that let me place my own links in an a tag’s href attribute. As expected, all strange values like javascript: were correctly filte… Read more