diff options
| author | Wu Cheng-Han | 2017-04-11 22:25:14 +0800 |
|---|---|---|
| committer | Wu Cheng-Han | 2017-04-11 22:25:14 +0800 |
| commit | 48df2504914d638d974e14c07908230d4e971211 (patch) | |
| tree | 49df4e1a81afbd379fd2d7f9ee36d91f1fa791f0 /public | |
| parent | a39870f224320856d43eb3377343f1c4229f11dd (diff) | |
Fix link regex should filter protocol with case insensitive flag [Security Issue]
Diffstat (limited to '')
| -rw-r--r-- | public/js/render.js | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/public/js/render.js b/public/js/render.js index d16181ab..88a05bde 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -4,7 +4,7 @@ var whiteListAttr = ['id', 'class', 'style'] window.whiteListAttr = whiteListAttr // allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript:// -var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/ +var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/i // allow data uri, from https://gist.github.com/bgrins/6194623 var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i // custom white list |