zhanshi/goldmark
1
0
Fork 0
mirror of https://github.com/yuin/goldmark synced 2025-03-04 23:04:52 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge pull request #298 from vincentbernat/fix/svg-avif-safe

Browse source 
renderer: image/svg is also safe
This commit is contained in:
Yusuke Inuzuka 2022-04-14 19:57:26 +09:00 committed by GitHub
commit 6bda32624d
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
renderer/html/html.go
View file

@ -819,6 +819,7 @@ var bPng = []byte("png;")
var bGif = []byte("gif;") var bGif = []byte("gif;")
var bJpeg = []byte("jpeg;") var bJpeg = []byte("jpeg;")
var bWebp = []byte("webp;") var bWebp = []byte("webp;")
var bSvg = []byte("svg;")
var bJs = []byte("javascript:") var bJs = []byte("javascript:")
var bVb = []byte("vbscript:") var bVb = []byte("vbscript:")
var bFile = []byte("file:") var bFile = []byte("file:")
@ -830,7 +831,8 @@ func IsDangerousURL(url []byte) bool {
if bytes.HasPrefix(url, bDataImage) && len(url) >= 11 { if bytes.HasPrefix(url, bDataImage) && len(url) >= 11 {
v := url[11:] v := url[11:]
if bytes.HasPrefix(v, bPng) || bytes.HasPrefix(v, bGif) || if bytes.HasPrefix(v, bPng) || bytes.HasPrefix(v, bGif) ||
bytes.HasPrefix(v, bJpeg) || bytes.HasPrefix(v, bWebp) { bytes.HasPrefix(v, bJpeg) || bytes.HasPrefix(v, bWebp) ||
bytes.HasPrefix(v, bSvg) {
return false return false
} }
return true return true