Fix safe href domain regex matching tel: protocols

trentm · Jul 10, 2023 · 28a54c3 · 28a54c3
1 parent 9c6017f
commit 28a54c3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/markdown2.py b/lib/markdown2.py
@@ -1522,7 +1522,7 @@ def _safe_href(self):
         # omitted ['"<>] for XSS reasons
         less_safe = r'#/\.!#$%&\(\)\+,/:;=\?@\[\]^`\{\}\|~'
         # dot seperated hostname, optional port number, not followed by protocol seperator
-        domain = r'(?:[%s]+(?:\.[%s]+)*)(?::\d+/?)?(?![^:/]*:/*)' % (safe, safe)
+        domain = r'(?:[%s]+(?:\.[%s]+)+)(?::\d+/?)?(?![^:/]*:/*)' % (safe, safe)
         fragment = r'[%s]*' % (safe + less_safe)
 
         return re.compile(r'^(?:(%s)?(%s)(%s)|(#|\.{,2}/)(%s))$' % (self._safe_protocols, domain, fragment, fragment), re.I)