fix: ignore whitespace when detecting protocol

unjs · Aug 24, 2023 · b1699e2 · b1699e2
1 parent d5773fe
commit b1699e2
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 2 deletions.
diff --git a/src/utils.ts b/src/utils.ts
@@ -7,8 +7,8 @@ export function isRelative(inputString: string) {
   return ["./", "../"].some((string_) => inputString.startsWith(string_));
 }
 
-const PROTOCOL_STRICT_REGEX = /^\w{2,}:([/\\]{1,2})/;
-const PROTOCOL_REGEX = /^\w{2,}:([/\\]{2})?/;
+const PROTOCOL_STRICT_REGEX = /^[\s\w\0]{2,}:([/\\]{1,2})/;
+const PROTOCOL_REGEX = /^[\s\w\0]{2,}:([/\\]{2})?/;
 const PROTOCOL_RELATIVE_REGEX = /^([/\\]\s*){2,}[^/\\]/;
 
 export interface HasProtocolOptions {

diff --git a/test/utilities.test.ts b/test/utilities.test.ts
@@ -28,6 +28,9 @@ describe("hasProtocol", () => {
 
     // Has protocol (non strict)
     { input: "tel:", out: [true, false, true] },
+    { input: "javascript:alert(true)", out: [true, false, true] },
+    { input: " javascript:alert(true)", out: [true, false, true] },
+    { input: "\0javascript:alert(true)", out: [true, false, true] },
     { input: "tel:123456", out: [true, false, true] },
     { input: "mailto:support@example.com", out: [true, false, true] },