From 1d4296f34d938758ff88755e4ac44ae1d3fc6857 Mon Sep 17 00:00:00 2001 From: naNuke Date: Sun, 25 Jan 2015 19:47:32 +0100 Subject: [PATCH] Customizable whitelist of schemas for safeLinks --- Parsedown.php | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/Parsedown.php b/Parsedown.php index 94dbe20..9882810 100644 --- a/Parsedown.php +++ b/Parsedown.php @@ -84,6 +84,14 @@ class Parsedown protected $safeLinksEnabled = true; + protected $safeLinksWhitelist = array( + 'http://', + 'https://', + '/', + 'ftp://', + 'ftps://' + ); + # # Lines # @@ -1262,9 +1270,22 @@ class Parsedown $Element['attributes']['title'] = $Definition['title']; } - if ( $this->safeLinksEnabled && preg_match("/^(\/|https?:\/\/|ftps?:\/\/)/ui", $Element['attributes']['href']) === 0 ) + if ( $this->safeLinksEnabled ) { - return; + $matched = false; + foreach ( $this->safeLinksWhitelist as $scheme ) + { + if ( stripos($Element['attributes']['href'], $scheme) === 0 ) + { + $matched = true; + break; + } + } + + if ( ! $matched ) + { + return; + } } $Element['attributes']['href'] = htmlspecialchars($Element['attributes']['href'], ENT_QUOTES);