mirrors/marked
1
0
Fork 0
mirror of https://github.com/markedjs/marked synced 2024-11-23 09:48:17 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

added data: link fix to prevent xss

Browse Source
This commit is contained in:
Matt Austin 2017-01-19 15:03:37 -08:00
parent 38f1727ffe
commit cd2f6f5b70
3 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/marked.js
View File

@ -875,7 +875,7 @@ Renderer.prototype.link = function(href, title, text) {
} catch (e) {
return '';
}
if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0) {
if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0 || prot.indexOf('data:') === 0) {
return '';
}
}

1
test/tests/links.sanitize.html
View File

@ -1,4 +1,5 @@
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>

4
test/tests/links.sanitize.text
View File

@ -4,4 +4,6 @@
[URL](javascript&colon;alert&#40;1&#41;)
[URL](javascript&#58document;alert&#40;1&#41;)
[URL](javascript&#58document;alert&#40;1&#41;)
[URL](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)