depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Fix link regex should filter protocol with case insensitive flag [Security Issue]

Browse source
This commit is contained in:
Wu Cheng-Han 2017-04-11 22:25:14 +08:00
parent a39870f224
commit 48df250491
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
public/js/render.js
View file

@ -4,7 +4,7 @@
var whiteListAttr = ['id', 'class', 'style'] var whiteListAttr = ['id', 'class', 'style']
window.whiteListAttr = whiteListAttr window.whiteListAttr = whiteListAttr
// allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript:// // allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript://
var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/ var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/i
// allow data uri, from https://gist.github.com/bgrins/6194623 // allow data uri, from https://gist.github.com/bgrins/6194623
var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i
// custom white list // custom white list