codewalker/marked
1
0
Fork 0
Code Pull Requests Actions Packages Releases Activity

Merge pull request #844 from chjj/data_link_fix

Browse Source 
added data link fix to prevent xss
This commit is contained in:
Matt Austin 2017-01-20 09:47:29 -08:00 committed by GitHub
commit 8f9d0b72f5
3 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/marked.js
View File

@ -875,7 +875,7 @@ Renderer.prototype.link = function(href, title, text) {
} catch (e) {
return '';
}
if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0) {
if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0 || prot.indexOf('data:') === 0) {
return '';
}
}

1
test/tests/links.sanitize.html
View File

@ -1,4 +1,5 @@
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>

4
test/tests/links.sanitize.text
View File

@ -4,4 +4,6 @@
[URL](javascript&colon;alert&#40;1&#41;)
[URL](javascript&#58document;alert&#40;1&#41;)
[URL](javascript&#58document;alert&#40;1&#41;)
[URL](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)