Nemcio/NodeBB
1
0
Fork 0
mirror of https://github.com/NodeBB/NodeBB.git synced 2025-10-29 01:56:12 +01:00
Code Issues Packages Projects Releases Wiki Activity

utilising whitelist instead of blacklisting javascript protocol

Browse Source
This commit is contained in:
Julian Lam
2017-10-10 11:48:06 -04:00
parent 5863d64d27
commit 72502ff992
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/controllers/index.js
View File

@@ -390,8 +390,10 @@ Controllers.manifest = function (req, res) {
Controllers.outgoing = function (req, res, next) {
var url = req.query.url || '';
var allowedProtocols = ['http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet', 'mms', 'rtsp', 'svn', 'tel', 'fax', 'xmpp', 'webcal'];
var parsed = require('url').parse(url);
if (!url || url.startsWith('javascript:')) {
if (!url || !allowedProtocols.includes(parsed.protocol.slice(0, -1))) {
return next();
}