diff options
| -rw-r--r-- | public/js/render.js | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/public/js/render.js b/public/js/render.js index 746820ae..d16181ab 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -3,8 +3,8 @@ // allow some attributes var whiteListAttr = ['id', 'class', 'style'] window.whiteListAttr = whiteListAttr -// allow link starts with '.', '/' and custom protocol with '://' -var linkRegex = /^([\w|-]+:\/\/)|^([.|/])+/ +// allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript:// +var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/ // allow data uri, from https://gist.github.com/bgrins/6194623 var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i // custom white list |