Skip to content

Commit

Permalink
Merge pull request #844 from chjj/data_link_fix
Browse files Browse the repository at this point in the history
added data link fix to prevent xss
  • Loading branch information
matt- authored Jan 20, 2017
2 parents 38f1727 + cd2f6f5 commit 8f9d0b7
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 2 deletions.
2 changes: 1 addition & 1 deletion lib/marked.js
Original file line number Diff line number Diff line change
Expand Up @@ -875,7 +875,7 @@ Renderer.prototype.link = function(href, title, text) {
} catch (e) {
return '';
}
if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0) {
if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0 || prot.indexOf('data:') === 0) {
return '';
}
}
Expand Down
1 change: 1 addition & 0 deletions test/tests/links.sanitize.html
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
<p></p>
<p></p>
<p></p>
<p></p>
<p></p>
4 changes: 3 additions & 1 deletion test/tests/links.sanitize.text
Original file line number Diff line number Diff line change
Expand Up @@ -4,4 +4,6 @@

[URL](javascript&colon;alert&#40;1&#41;)

[URL](javascript&#58document;alert&#40;1&#41;)
[URL](javascript&#58document;alert&#40;1&#41;)

[URL](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

0 comments on commit 8f9d0b7

Please sign in to comment.