using the already present hrefSanitizationRegex from the urlHrefwhitelist for the parsing of user generated markdown links
@@ -163,14 +163,14 @@ app.config(configRouting).config([
"$compileProvider",
"markedProvider",
function($compileProvider, markedProvider) {
- $compileProvider.aHrefSanitizationWhitelist(
- /^\s*(https?|ftp|mailto|tel|file|blob|data):/
- );
+ const urlSanitizationRegex = /^\s*(https?|ftp|mailto|tel|file|blob|data):/;
+
+ $compileProvider.aHrefSanitizationWhitelist(urlSanitizationRegex);
markedProvider.setOptions({ sanitize: true });
- /*
//removed this codesnippet due to problems with link rendering -> xss vulnerability
markedProvider.setRenderer({
link: function(href, title, text) {
+ if (urlSanitizationRegex.test(href)) {
return (
'<a href="' +
href +
@@ -180,8 +180,11 @@ app.config(configRouting).config([
text +
"</a>"
);
+ } else {
+ return text;
+ }
},
- });*/
+ });
},
]);
app.run(["$ngRedux", $ngRedux => runMessagingAgent($ngRedux)]);
