finn/forgejo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Disallow dangerous url schemes (#25960)

Browse source 
Regression: https://github.com/go-gitea/gitea/pull/24805
Closes: #25945

- Disallow `javascript`, `vbscript` and `data` (data uri images still
work) url schemes even if all other schemes are allowed
- Fixed older `cbthunderlink` tests

---------

Co-authored-by: delvh <dev.lh@web.de>
This commit is contained in:
KN4CK3R 2023-07-18 17:18:37 +02:00 • committed by GitHub
parent cc73e84fa3
commit 8af96f585f
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 19 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

2
go.mod
View file

@ -76,7 +76,7 @@ require (
github.com/mattn/go-sqlite3 v1.14.17
github.com/meilisearch/meilisearch-go v0.25.0
github.com/mholt/archiver/v3 v3.5.1
github.com/microcosm-cc/bluemonday v1.0.24
github.com/microcosm-cc/bluemonday v1.0.25
github.com/minio/minio-go/v7 v7.0.60
github.com/minio/sha256-simd v1.0.1
github.com/msteinert/pam v1.1.0