diff options
Diffstat (limited to '')
| -rw-r--r-- | public/js/render.js | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/public/js/render.js b/public/js/render.js index ff1ec9b3..6f1a1c19 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -2,6 +2,8 @@ var whiteListAttr = ['id', 'class', 'style']; // allow link starts with '.', '/' and custom protocol with '://' var linkRegex = /^([\w|-]+:\/\/)|^([\.|\/])+/; +// allow data uri, from https://gist.github.com/bgrins/6194623 +var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@\/?%\s]*)\s*$/i; // custom white list var whiteList = filterXSS.whiteList; // allow ol specify start number @@ -32,6 +34,10 @@ var filterXSSOptions = { if (isWhiteAttr && (name === 'href' || name === 'src') && linkRegex.test(value)) { return name + '="' + filterXSS.escapeAttrValue(value) + '"'; } + // allow data uri in img src + if (isWhiteAttr && (tag == "img" && name === 'src') && dataUriRegex.test(value)) { + return name + '="' + filterXSS.escapeAttrValue(value) + '"'; + } }, onIgnoreTagAttr: function (tag, name, value, isWhiteAttr) { // allow attr start with 'data-' or in the whiteListAttr |