From 48df2504914d638d974e14c07908230d4e971211 Mon Sep 17 00:00:00 2001 From: Wu Cheng-Han Date: Tue, 11 Apr 2017 22:25:14 +0800 Subject: Fix link regex should filter protocol with case insensitive flag [Security Issue] --- public/js/render.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/js/render.js b/public/js/render.js index d16181ab..88a05bde 100644 --- a/public/js/render.js +++ b/public/js/render.js @@ -4,7 +4,7 @@ var whiteListAttr = ['id', 'class', 'style'] window.whiteListAttr = whiteListAttr // allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript:// -var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/ +var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/i // allow data uri, from https://gist.github.com/bgrins/6194623 var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i // custom white list -- cgit v1.2.3