From 2a66fb8fbfa8255f4939b874057e6a947e4c8bf0 Mon Sep 17 00:00:00 2001
From: Alex Kocharin <alex@kocharin.ru>
Date: Tue, 10 Mar 2015 17:23:53 +0300
Subject: [PATCH] Remove replaceEntities from validateLink

Entities will usually be replaced with unescapeAll before they
go through the validator.
---
 lib/index.js                      | 8 +++-----
 test/fixtures/markdown-it/xss.txt | 5 ++++-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/lib/index.js b/lib/index.js
index 98c69e2..6a0310e 100644
--- a/lib/index.js
+++ b/lib/index.js
@@ -21,14 +21,12 @@ var config = {
 };
 
 
-var replaceEntities = require('./common/utils').replaceEntities;
 var BAD_PROTOCOLS   = [ 'vbscript', 'javascript', 'file' ];
 
 function validateLink(url) {
-  // Care about digital entities "javascript&#x3A;alert(1)"
-  var str = replaceEntities(url);
-
-  str = str.trim().toLowerCase();
+  // url should be normalized at this point, and existing entities are decoded
+  //
+  var str = url.trim().toLowerCase();
 
   if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
     return false;
diff --git a/test/fixtures/markdown-it/xss.txt b/test/fixtures/markdown-it/xss.txt
index 8909583..25eb361 100644
--- a/test/fixtures/markdown-it/xss.txt
+++ b/test/fixtures/markdown-it/xss.txt
@@ -31,10 +31,13 @@ Should not allow some protocols in links and images
 [xss link](&#74;avascript:alert(1))
 
 [xss link](&#x26;#74;avascript:alert(1))
+
+[xss link](\&#74;avascript:alert(1))
 .
 <p><a href="%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E">xss link</a></p>
 <p>[xss link](Javascript:alert(1))</p>
-<p>[xss link](&amp;#74;avascript:alert(1))</p>
+<p><a href="&amp;#74;avascript:alert(1)">xss link</a></p>
+<p><a href="&amp;#74;avascript:alert(1)">xss link</a></p>
 .
 
 .