deac/instiki
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

More lenient URI scheme matching in sanitize.

Browse source
This commit is contained in:
Jacques Distler 2007-02-24 22:47:31 -06:00
parent f9dcfa5af0
commit 507a17aade
2 changed files with 15 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/sanitize.rb
View file

@ -143,8 +143,8 @@ module Sanitize
if node.closing != :close
node.attributes.delete_if { |attr,v| !ALLOWED_ATTRIBUTES.include?(attr) }
ATTR_VAL_IS_URI.each do |attr|
val_unescaped = CGI.unescapeHTML(node.attributes[attr].to_s).gsub(/[\000-\040\177-\240]+/,'')
if val_unescaped =~ /^\w+:/ and !ALLOWED_PROTOCOLS.include?(val_unescaped.split(':')[0])
val_unescaped = CGI.unescapeHTML(node.attributes[attr].to_s).gsub(/[\000-\040\177-\240]+/,'').downcase
if val_unescaped =~ /^[+-.\w]+:/ and !ALLOWED_PROTOCOLS.include?(val_unescaped.split(':')[0])
node.attributes.delete attr
end
end