litruv/lit.ruv.wtf
1
0
Fork 0
mirror of https://github.com/litruv/lit.ruv.wtf.git synced 2026-07-24 02:36:02 +10:00
Code Issues Packages Projects Releases Wiki Activity

fix: Update URL sanitization logic in Markdown renderer

Browse Source
This commit is contained in:
Litruv
2026-05-10 19:24:14 +10:00
parent 4e4665c4ca
commit 01bac4c0bd
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
website/scripts/MarkdownRenderer.js
View File

@@ -402,7 +402,7 @@ export class MarkdownRenderer {
static #sanitizeUrl(url) { static #sanitizeUrl(url) {
const trimmed = url.trim(); const trimmed = url.trim();
// Allow absolute URLs, root-relative, hash links, relative-dot paths, and plain relative paths // Allow absolute URLs, root-relative, hash links, relative-dot paths, and plain relative paths
if (/^(https?:\/\/|mailto:|blob:|\/|#|\.)/.test(trimmed)) return trimmed; if (/^(https?:\/\/|mailto:|\/|#|\.)/.test(trimmed)) return trimmed;
// Allow relative paths (e.g. data/blog/media/image.png) — no protocol = safe relative // Allow relative paths (e.g. data/blog/media/image.png) — no protocol = safe relative
if (/^[a-zA-Z0-9_\-][a-zA-Z0-9_.\-\/]*$/.test(trimmed)) return trimmed; if (/^[a-zA-Z0-9_\-][a-zA-Z0-9_.\-\/]*$/.test(trimmed)) return trimmed;
return null; return null;