LPS-84268 Let sanitizer allow * character in URLs

stian-sigvartsen · Aug 24, 2018 · fe567cc · fe567cc
1 parent fe296ab
commit fe567cc
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/modules/apps/portal-security/portal-security-antisamy/build.gradle b/modules/apps/portal-security/portal-security-antisamy/build.gradle
@@ -43,7 +43,10 @@ processSanitizerConfiguration {
 		}
 
 		if (line.contains('<regexp name="onsiteURL" value=')) {
-			line = '		<regexp name="onsiteURL" value="^(?![\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&amp;;\\-_~,\\?=/!]*(&amp;colon))[\\p{L}\\p{N}\\\\\\.\\#@\\$%\\+&amp;;\\-_~,\\?=/!]*"/>'
+			line = '		<regexp name="onsiteURL" value="^(?![\\p{L}\\p{N}\\\\\\.\\#@\\$%\\*\\+&amp;;\\-_~,\\?=/!]*(&amp;colon))[\\p{L}\\p{N}\\\\\\.\\#@\\$%\\*\\+&amp;;\\-_~,\\?=/!]*"/>'
+		}
+		else if (line.contains('<regexp name="offsiteURL" value=')) {
+			line = '		<regexp name="offsiteURL" value="(\\s)*((ht|f)tp(s?)://|mailto:)[\\p{L}\\p{N}]+[\\p{L}\\p{N}\\p{Zs}\\.\\#@\\$%\\*\\+&amp;;:\\-_~,\\?=/!\\(\\)]*(\\s)*"/>'
 		}
 		else if (line.contains('<tag-rules>')) {
 			line = """\