| … | … | @@ -9,7 +9,15 @@ window.renderMarkdown = function (src) { |
| 9 | 9 | |
| 10 | 10 | // Escape HTML |
| 11 | 11 | function esc (s) { |
| 12 | return s.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>') | |
| 12 | return s.replace(/&/g, '&').replace(/</g, '<').replace(/>/g, '>').replace(/"/g, '"') | |
| 13 | } | |
| 14 | ||
| 15 | function safeUrl (url) { | |
| 16 | var decoded = url | |
| 17 | try { decoded = decodeURIComponent(url) } catch (e) {} | |
| 18 | var trimmed = decoded.trim().toLowerCase() | |
| 19 | if (trimmed.startsWith('javascript:') || trimmed.startsWith('data:') || trimmed.startsWith('blob:') || trimmed.startsWith('vbscript:')) return '' | |
| 20 | return url | |
| 13 | 21 | } |
| 14 | 22 | |
| 15 | 23 | var lines = src.split('\n') |