mirror/parsedown
1
0
Fork 0
mirror of https://github.com/erusev/parsedown.git synced 2023-08-10 21:13:06 +03:00
Code Releases Activity

whitelist changes:

Browse Source 
* add gif and jpg as allowed data images
* ensure that user controlled content fall only in the "data section" of the data URI (and does not intersect content-type definition in any way (best to be safe than sorry ;-)))
  "data section" as defined in: https://tools.ietf.org/html/rfc2397#section-3
This commit is contained in:
Aidan Woods 2017-05-02 19:48:08 +01:00
parent e4bb12329e
commit 4dc98b635d
No known key found for this signature in database
GPG Key ID: 9A6A8EFAA512BBB9
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Parsedown.php
View File

@ -91,7 +91,9 @@ class Parsedown
'ftp://',
'ftps://',
'mailto:',
'data:image/png;',
'data:image/png;base64,',
'data:image/gif;base64,',
'data:image/jpg;base64,',
);
#