fix: Invalid scheme check in Attr.TargetBlank (#363)

ezyang · Jan 27, 2023 · 0176ef4 · 0176ef4
1 parent 78a9b4d
commit 0176ef4
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/library/HTMLPurifier/AttrTransform/TargetBlank.php b/library/HTMLPurifier/AttrTransform/TargetBlank.php
@@ -33,7 +33,11 @@ public function transform($attr, $config, $context)
 
         // XXX Kind of inefficient
         $url = $this->parser->parse($attr['href']);
-        $scheme = $url->getSchemeObj($config, $context);
+
+        // Ignore invalid schemes (e.g. `javascript:`)
+        if (!($scheme = $url->getSchemeObj($config, $context))) {
+            return $attr;
+        }
 
         if ($scheme->browsable && !$url->isBenign($config, $context)) {
             $attr['target'] = '_blank';