Sanitize output from Helper.urls2links

2020-05-30 06:05:20 -04:00 · 2020-05-30 06:05:20 -04:00 · 5f0011b0f6
parent 25a39148a8
commit 5f0011b0f6
1 changed files with 5 additions and 3 deletions
--- a/js/privatebin.js
+++ b/js/privatebin.js
@ -405,10 +405,12 @@ jQuery.PrivateBin = (function($, RawDeflate) {
        me.urls2links = function(element)
        {
            element.html(
+                DOMPurify.sanitize(
                    element.html().replace(
                        /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig,
                        '<a href="$1" rel="nofollow">$1</a>'
                    )
+                )
            );
        };