|
|
@ -11,6 +11,7 @@ var ParserBlock = require('./parser_block'); |
|
|
|
var ParserInline = require('./parser_inline'); |
|
|
|
var LinkifyIt = require('linkify-it'); |
|
|
|
|
|
|
|
|
|
|
|
var config = { |
|
|
|
'default': require('./presets/default'), |
|
|
|
zero: require('./presets/zero'), |
|
|
@ -18,6 +19,22 @@ var config = { |
|
|
|
}; |
|
|
|
|
|
|
|
|
|
|
|
var replaceEntities = require('./common/utils').replaceEntities; |
|
|
|
var BAD_PROTOCOLS = [ 'vbscript', 'javascript', 'file' ]; |
|
|
|
|
|
|
|
function validateLink(url) { |
|
|
|
// Care about digital entities "javascript:alert(1)"
|
|
|
|
var str = replaceEntities(url); |
|
|
|
|
|
|
|
str = str.trim().toLowerCase(); |
|
|
|
|
|
|
|
if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) { |
|
|
|
return false; |
|
|
|
} |
|
|
|
return true; |
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
/** |
|
|
|
* class MarkdownIt |
|
|
|
* |
|
|
@ -202,6 +219,22 @@ function MarkdownIt(presetName, options) { |
|
|
|
**/ |
|
|
|
this.linkify = new LinkifyIt(); |
|
|
|
|
|
|
|
/** |
|
|
|
* MarkdownIt#validateLink(url) -> Boolean |
|
|
|
* |
|
|
|
* Link validation function. CommonMark allows too much in links. By default |
|
|
|
* we disable `javascript:` and `vbscript:` schemas. You can change this |
|
|
|
* behaviour. |
|
|
|
* |
|
|
|
* ```javascript
|
|
|
|
* var md = require('markdown-it')(); |
|
|
|
* // enable everything
|
|
|
|
* md.validateLink = function () { return true; } |
|
|
|
* ``` |
|
|
|
**/ |
|
|
|
this.validateLink = validateLink; |
|
|
|
|
|
|
|
|
|
|
|
// Expose utils & helpers for easy acces from plugins
|
|
|
|
|
|
|
|
/** |
|
|
|