|
@@ -6,23 +6,40 @@ var Markdown = require('markdown-it')({
|
|
|
breaks: true,
|
|
|
});
|
|
|
|
|
|
+
|
|
|
+// Static URL Scheme Listing
|
|
|
+var urlschemes = [
|
|
|
+ "aodroplink",
|
|
|
+ "thunderlink",
|
|
|
+ "cbthunderlink",
|
|
|
+ "onenote",
|
|
|
+ "file",
|
|
|
+ "abasurl",
|
|
|
+ "conisio",
|
|
|
+ "mailspring"
|
|
|
+];
|
|
|
+
|
|
|
+// Better would be a field in the admin backend to set this dynamically
|
|
|
+// instead of putting all known or wanted url schemes here hard into code
|
|
|
+// but i was not able to access those settings
|
|
|
+// var urlschemes = currentSetting.automaticLinkedUrlSchemes.split('\n');
|
|
|
+
|
|
|
+// put all url schemes into the linkify configuration to automatically make it clickable
|
|
|
+for(var i=0; i<urlschemes.length;i++){
|
|
|
+ //console.log("adding autolink for "+urlschemes[i]);
|
|
|
+ Markdown.linkify.add(urlschemes[i]+":",'http:');
|
|
|
+}
|
|
|
+
|
|
|
// Additional safeAttrValue function to allow for other specific protocols
|
|
|
// See https://github.com/leizongmin/js-xss/issues/52#issuecomment-241354114
|
|
|
function mySafeAttrValue(tag, name, value, cssFilter) {
|
|
|
// only when the tag is 'a' and attribute is 'href'
|
|
|
// then use your custom function
|
|
|
if (tag === 'a' && name === 'href') {
|
|
|
- // only filter the value if starts with 'cbthunderlink:' or 'aodroplink'
|
|
|
- if (/^thunderlink:/ig.test(value) ||
|
|
|
- /^cbthunderlink:/ig.test(value) ||
|
|
|
- /^aodroplink:/ig.test(value) ||
|
|
|
- /^onenote:/ig.test(value) ||
|
|
|
- /^file:/ig.test(value) ||
|
|
|
- /^abasurl:/ig.test(value) ||
|
|
|
- /^conisio:/ig.test(value) ||
|
|
|
- /^mailspring:/ig.test(value)) {
|
|
|
- return value;
|
|
|
- }
|
|
|
+ // only filter the value if starts with an registered url scheme
|
|
|
+ urlscheme = value.split(/:\/\//);
|
|
|
+ //console.log("validating "+urlscheme[0]);
|
|
|
+ if(urlschemes.includes(urlscheme[0])) return value;
|
|
|
else {
|
|
|
// use the default safeAttrValue function to process all non cbthunderlinks
|
|
|
return sanitizeXss.safeAttrValue(tag, name, value, cssFilter);
|