diff options
Diffstat (limited to 'modules/ext/critical-ext-bundle.js')
| -rw-r--r-- | modules/ext/critical-ext-bundle.js | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/modules/ext/critical-ext-bundle.js b/modules/ext/critical-ext-bundle.js index 9def12d..4242ebf 100644 --- a/modules/ext/critical-ext-bundle.js +++ b/modules/ext/critical-ext-bundle.js @@ -894,8 +894,11 @@ class FileManagerModule { html = html.replace(/\*\*(.+?)\*\*/g, '<strong>$1</strong>'); // italic html = html.replace(/\*(.+?)\*/g, '<em>$1</em>'); - // links - html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, '<a href="$2" target="_blank" style="color:var(--info-color)">$1</a>'); + // links — v4.5.67: sanitize URL to prevent javascript: scheme injection + html = html.replace(/\[([^\]]+)\]\(([^)]+)\)/g, (match, text, url) => { + const safeUrl = /^(https?:\/\/|mailto:|\/|#)/.test(url) ? url : '#'; + return `<a href="${safeUrl}" target="_blank" style="color:var(--info-color)">${text}</a>`; + }); // horizontal rules html = html.replace(/^---$/gm, '<hr style="border-color:var(--border-color);margin:8px 0">'); // unordered lists |