diff options
| author | Manu <manu.1982@gmail.com> | 2012-01-12 16:13:26 +0530 |
|---|---|---|
| committer | Manu <manu.1982@gmail.com> | 2012-01-12 16:13:26 +0530 |
| commit | e7e4deec117154d34db1b18341c00c497e65e089 (patch) | |
| tree | ed2e1c9d19201cd4894d7601c726e4be5c2d0b2a /actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb | |
| parent | 838d30f182b1fa0cabd977e98fc47b4adb2064e4 (diff) | |
| download | rails-e7e4deec117154d34db1b18341c00c497e65e089.tar.gz rails-e7e4deec117154d34db1b18341c00c497e65e089.tar.bz2 rails-e7e4deec117154d34db1b18341c00c497e65e089.zip | |
Handle leading spaces in protocol while sanitizing
Diffstat (limited to 'actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb')
| -rw-r--r-- | actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb index af06bffa16..24ffc28710 100644 --- a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb +++ b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb @@ -171,7 +171,7 @@ module HTML def contains_bad_protocols?(attr_name, value) uri_attributes.include?(attr_name) && - (value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase)) + (value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip)) end end end |