Added hook to validate links

README.md

@@ -8,13 +8,13 @@ remarkable
 
 Markdown parser done right. Fast and easy to extend.
 
+__[Live demo](http://jonschlinkert.github.io/remarkable/demo/)__
+
 - Configurable syntax! You can add new rules and even replace existing ones.
 - Implements [CommonMark](http://commonmark.org/) spec + extentions
   (strikethrough, tables, URL autolinking, typographer).
 - Very high speed.
 
-__[Live demo](http://jonschlinkert.github.io/remarkable/demo/)__
-
 
 ## Install
 

lib/links.js

@@ -124,6 +124,8 @@ function parseLinkDestination(state, pos) {
 
   if (!href.length) { return false; }
 
+  if (!state.parser.validateLink(href)) { return false; }
+
   state.pos = pos;
   state.link_content = href;
   return true;

lib/parser_inline.js

@@ -25,6 +25,10 @@ rules.push(require('./rules_inline/htmltag'));
 rules.push(require('./rules_inline/entity'));
 rules.push(require('./rules_inline/escape_html_char'));
 
+function validateLink(url) {
+  if (url.indexOf('javas' + 'cript:') === 0) { return false; }
+  return true;
+}
 
 // Inline Parser class
 //
@@ -36,6 +40,10 @@ function ParserInline() {
   // - '<>"' added for internal html escaping
   this.textMatch = /^[^\n\\`*_\[\]!&{}$%@<>"~]+/;
 
+  // By default CommonMark allows too much in links
+  // If you need to restrict it - override this with your validator.
+  this.validateLink = validateLink;
+
   this.ruler = new Ruler(this.rulesUpdate.bind(this));
 
   for (var i = 0; i < rules.length; i++) {

lib/rules_inline/autolink.js

@@ -11,7 +11,7 @@ var AUTOLINK_RE = /^<([a-zA-Z.\-]{1,25}):([^<>\x00-\x20]*)>/;
 
 
 module.exports = function autolink(state) {
-  var tail, linkMatch, emailMatch, pos = state.pos;
+  var tail, linkMatch, emailMatch, url, pos = state.pos;
 
   if (state.src.charCodeAt(pos) !== 0x3C/* < */) { return false; }
 
@@ -24,14 +24,18 @@ module.exports = function autolink(state) {
   if (linkMatch) {
     if (url_schemas.indexOf(linkMatch[1].toLowerCase()) < 0) { return false; }
 
+    url = linkMatch[0].slice(1, -1);
+
+    if (!state.parser.validateLink(url)) { return false; }
+
     state.push({
       type: 'link_open',
-      href: linkMatch[0].slice(1, -1),
+      href: url,
       level: state.level
     });
     state.push({
       type: 'text',
-      content: escapeHtml(linkMatch[0].slice(1, -1)),
+      content: escapeHtml(url),
       level: state.level + 1
     });
     state.push({ type: 'link_close', level: state.level });
@@ -43,14 +47,19 @@ module.exports = function autolink(state) {
   emailMatch = tail.match(EMAIL_RE);
 
   if (emailMatch) {
+
+    url = emailMatch[0].slice(1, -1);
+
+    if (!state.parser.validateLink('mailto:' + url)) { return false; }
+
     state.push({
       type: 'link_open',
-      href: 'mailto:' + emailMatch[0].slice(1, -1),
+      href: 'mailto:' + url,
       level: state.level
     });
     state.push({
       type: 'text',
-      content: escapeHtml(emailMatch[0].slice(1, -1)),
+      content: escapeHtml(url),
       level: state.level + 1
     });
     state.push({ type: 'link_close', level: state.level });

lib/rules_typographer/linkify.js

@@ -14,12 +14,8 @@ var autolinker = new Autolinker({
   stripPrefix: false,
   replaceFn: function (autolinker, match) {
     // Only collect matched strings but don't change anything.
-    var url;
     if (match.getType() === 'url') {
-      url = match.getUrl();
-      if (/^(http|https|ftp|git)/.test(url)) {
-        links.push(url);
-      }
+      links.push(match.getUrl());
     }
     return false;
   }
@@ -57,6 +53,9 @@ module.exports = function linkify(t, state) {
       level = token.level;
 
       for (ln = 0; ln < links.length; ln++) {
+
+        if (!state.parser.validateLink(links[ln])) { continue; }
+
         pos = text.indexOf(links[ln]);
         if (pos) {
           level = level;