From 48df2504914d638d974e14c07908230d4e971211 Mon Sep 17 00:00:00 2001
From: Wu Cheng-Han
Date: Tue, 11 Apr 2017 22:25:14 +0800
Subject: Fix link regex should filter protocol with case insensitive flag
 [Security Issue]

---
 public/js/render.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'public/js')

diff --git a/public/js/render.js b/public/js/render.js
index d16181ab..88a05bde 100644
--- a/public/js/render.js
+++ b/public/js/render.js
@@ -4,7 +4,7 @@
 var whiteListAttr = ['id', 'class', 'style']
 window.whiteListAttr = whiteListAttr
 // allow link starts with '.', '/' and custom protocol with '://', exclude link starts with javascript://
-var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/
+var linkRegex = /^(?!javascript:\/\/)([\w|-]+:\/\/)|^([.|/])+/i
 // allow data uri, from https://gist.github.com/bgrins/6194623
 var dataUriRegex = /^\s*data:([a-z]+\/[a-z0-9-+.]+(;[a-z-]+=[a-z0-9-]+)?)?(;base64)?,([a-z0-9!$&',()*+;=\-._~:@/?%\s]*)\s*$/i
 // custom white list
-- 
cgit v1.2.3