Merge pull request #1336 from JFox23/issue_1327

fix: #1327 escape URL for safe use in regular expression
JiHong88 · Dec 6, 2023 · 4210ad8 · 4210ad8
2 parents 8443bbb + 39cf59a
commit 4210ad8
Show file tree

Hide file tree

Showing 2 changed files with 18 additions and 1 deletion.
diff --git a/src/lib/util.js b/src/lib/util.js
@@ -1783,6 +1783,23 @@ const util = {
         }.bind(this));
     },
 
+	/**
+	 * @description Escape a string for safe use in regular expressions.
+	 * @param {String} string String to escape
+	 * @returns {String}
+	 */
+	escapeStringRegexp: function (string) {
+		if (typeof string !== 'string') {
+			throw new TypeError('Expected a string');
+		}
+
+		// Escape characters with special meaning either inside or outside character sets.
+		// Use a simple backslash escape when it’s always valid, and a `\xnn` escape when the simpler form would be disallowed by Unicode patterns’ stricter grammar.
+		return string
+			.replace(/[|\\{}()[\]^$+*?.]/g, '\\$&')
+			.replace(/-/g, '\\x2d');
+	},
+
     _isExcludeSelectionElement: function (element) {
         return !/FIGCAPTION/i.test(element.nodeName) && (this.isComponent(element) || /FIGURE/i.test(element.nodeName));
     },

diff --git a/src/plugins/modules/_anchor.js b/src/plugins/modules/_anchor.js
@@ -303,7 +303,7 @@ export default {
         const protocol = this.options.linkProtocol;
         const noPrefix = this.options.linkNoPrefix;
         const reservedProtocol  = /^(mailto\:|tel\:|sms\:|https*\:\/\/|#)/.test(value) || value.indexOf(protocol) === 0;
-        const sameProtocol = !protocol ? false : this._w.RegExp('^' + value.substr(0, protocol.length)).test(protocol);
+        const sameProtocol = !protocol ? false : this._w.RegExp('^' + this.util.escapeStringRegexp(value.substr(0, protocol.length))).test(protocol);
         value = context.linkValue = preview.textContent = !value ? '' : noPrefix ? value : (protocol && !reservedProtocol && !sameProtocol) ? protocol + value : reservedProtocol ? value : /^www\./.test(value) ? 'http://' + value : this.context.anchor.host + (/^\//.test(value) ? '' : '/') + value;
 
         if (this.plugins.anchor.selfPathBookmark.call(this, value)) {