Merge pull request markedjs#844 from chjj/data_link_fix

added data link fix to prevent xss
zhenalexfan · Jan 20, 2017 · 2498312 · 2498312
2 parents 3bdcdcd + 639f415
commit 2498312
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 2 deletions.
diff --git a/lib/marked.js b/lib/marked.js
@@ -875,7 +875,7 @@ Renderer.prototype.link = function(href, title, text) {
     } catch (e) {
       return '';
     }
-    if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0) {
+    if (prot.indexOf('javascript:') === 0 || prot.indexOf('vbscript:') === 0 || prot.indexOf('data:') === 0) {
       return '';
     }
   }

diff --git a/test/tests/links.sanitize.html b/test/tests/links.sanitize.html
@@ -1,4 +1,5 @@
 <p></p>
 <p></p>
 <p></p>
+<p></p>
 <p></p>
diff --git a/test/tests/links.sanitize.text b/test/tests/links.sanitize.text
@@ -4,4 +4,6 @@
 
 [URL](javascript&colon;alert&#40;1&#41;)
 
-[URL](javascript&#58document;alert&#40;1&#41;)
+[URL](javascript&#58document;alert&#40;1&#41;)
+
+[URL](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)
-Original file line number
+Diff line change
@@ -1,4 +1,5 @@
     <p></p>
     <p></p>
     <p></p>
+    <p></p>
     <p></p>