<amp-pinterest> Sanitize URLs (#13885)

* Encode all UR components to sanitize them * Assert that all URLs are http or https
ampproject · Mar 8, 2018 · deb5a66 · deb5a66
1 parent 652a6b7
commit deb5a66
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/extensions/amp-pinterest/0.1/pin-widget.js b/extensions/amp-pinterest/0.1/pin-widget.js
@@ -16,7 +16,7 @@
 
 import {Services} from '../../../src/services';
 import {Util} from './util';
-import {assertHttpsUrl} from '../../../src/url';
+import {assertAbsoluteHttpOrHttpsUrl, assertHttpsUrl} from '../../../src/url';
 import {openWindowDialog} from '../../../src/dom';
 import {toWin} from '../../../src/types';
 
@@ -57,6 +57,7 @@ export class PinWidget {
     const href = el.getAttribute('data-pin-href');
     const log = el.getAttribute('data-pin-log');
     if (href) {
+      assertAbsoluteHttpOrHttpsUrl(href);
       if (shouldPop) {
         openWindowDialog(window, href, '_pinit', POP);
       } else {