Permalink
Browse files

utilising whitelist instead of blacklisting javascript protocol

  • Loading branch information...
julianlam committed Oct 10, 2017
1 parent 5863d64 commit 72502ff9923ed7d467209bc398635f55bad4be2a
Showing with 3 additions and 1 deletion.
  1. +3 −1 src/controllers/index.js
@@ -390,8 +390,10 @@ Controllers.manifest = function (req, res) {
Controllers.outgoing = function (req, res, next) {
var url = req.query.url || '';
var allowedProtocols = ['http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet', 'mms', 'rtsp', 'svn', 'tel', 'fax', 'xmpp', 'webcal'];
var parsed = require('url').parse(url);
if (!url || url.startsWith('javascript:')) {
if (!url || !allowedProtocols.includes(parsed.protocol.slice(0, -1))) {
return next();
}

0 comments on commit 72502ff

Please sign in to comment.