summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorWu Cheng-Han2017-04-11 22:25:14 +0800
committerWu Cheng-Han2017-04-11 22:25:14 +0800
commit48df2504914d638d974e14c07908230d4e971211 (patch)
tree49df4e1a81afbd379fd2d7f9ee36d91f1fa791f0
parenta39870f224320856d43eb3377343f1c4229f11dd (diff)
Fix link regex should filter protocol with case insensitive flag [Security Issue]
Diffstat (limited to '')
-rw-r--r--public/js/render.js2
1 files changed, 1 insertions, 1 deletions
diff --git a/public/js/render.js b/public/js/render.js
index d16181ab..88a05bde 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -4,7 +4,7 @@
var whiteListAttr = ['id', 'class', 'style']
window.whiteListAttr = whiteListAttr
// allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript://
-var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/
+var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/i
// allow data uri, from https://gist.github.com/bgrins/6194623
var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i
// custom white list