diff --git a/lib/index.js b/lib/index.js index 7e1f7e4..84e20ea 100644 --- a/lib/index.js +++ b/lib/index.js @@ -30,7 +30,7 @@ var config = { // var BAD_PROTO_RE = /^(vbscript|javascript|file|data):/; -var GOOD_DATA_RE = /^data:image\/(gif|png|jpeg|webp);/; +var GOOD_DATA_RE = /^data:image\/(gif|png|jpeg|svg\+xml|webp);/; function validateLink(url) { // url should be normalized at this point, and existing entities are decoded diff --git a/test/misc.js b/test/misc.js index e71ad35..4257e59 100644 --- a/test/misc.js +++ b/test/misc.js @@ -294,6 +294,33 @@ describe('Links validation', function () { assert.strictEqual(md.render('![test](http://example.com)'), '

![test](http://example.com)

\n'); }); + it('default should allow common data:image/*', function () { + var md = markdownit(); + + assert.strictEqual(md.render('![test](data:image/gif;base64,)'), '

test

\n'); + assert.strictEqual(md.render('![test](data:image/png;base64,)'), '

test

\n'); + assert.strictEqual(md.render('![test](data:image/jpeg;base64,)'), '

test

\n'); + assert.strictEqual(md.render('![test](data:image/svg+xml;base64,)'), '

test

\n'); + assert.strictEqual(md.render('![test](data:image/webp;base64,)'), '

test

\n'); + }); + + it('default should allow tel: and map:', function () { + var md = markdownit(); + + assert.strictEqual(md.render('[Call me](tel:1234567)'), '

Call me

\n'); + assert.strictEqual(md.render('[Track me](map:12.3,45.6)'), '

Track me

\n'); + }); + + it('default should skip blocklisted protocols', function () { + var md = markdownit(); + + assert.strictEqual(md.render('![test](data:image/x-something;base64,)'), '

![test](data:image/x-something;base64,)

\n'); + assert.strictEqual(md.render('![test](data:text/javascript;base64,)'), '

![test](data:text/javascript;base64,)

\n'); + assert.strictEqual(md.render('![test](vbscript:alert())'), '

![test](vbscript:alert())

\n'); + assert.strictEqual(md.render('![test](javascript:alert())'), '

![test](javascript:alert())

\n'); + assert.strictEqual(md.render('![test](file:/root.txt)'), '

![test](file:/root.txt)

\n'); + }); + });