search

MrDian / pagedown

Automatically exported from code.google.com/p/pagedown
0 stars 0 forks source link

Treat `:` as `:` in URLs #33

Closed GoogleCodeExporter closed 8 years ago

GoogleCodeExporter commented 8 years ago 
Fixes an XSS vulnerability reported by Mario Heiderich 
(http://twitter.com/0x6d6172696f).

This change ensures that…

   new Markdown.Converter().makeHtml('**_[Free iPad Here!](javascript:alert(1))_**')

…has the same result as…

   new Markdown.Converter().makeHtml('**_[Free iPad Here!](javascript:alert(1))_**')

Original issue reported on code.google.com by mathias@qiwi.be on 9 Aug 2012 at 12:18

Attachments: