diff options
| author | Aaron Patterson <aaron.patterson@gmail.com> | 2012-01-12 09:39:19 -0800 |
|---|---|---|
| committer | Aaron Patterson <aaron.patterson@gmail.com> | 2012-01-12 09:39:19 -0800 |
| commit | aa0f95559905e04026e5910876b3bb0d3271e9a4 (patch) | |
| tree | 3117572c7b6b1eb22617acf951a7df54e2fd2cd7 /actionpack/lib | |
| parent | daf435d20ccdad86de400c4cfaacf54510c7ab6d (diff) | |
| parent | e7e4deec117154d34db1b18341c00c497e65e089 (diff) | |
| download | rails-aa0f95559905e04026e5910876b3bb0d3271e9a4.tar.gz rails-aa0f95559905e04026e5910876b3bb0d3271e9a4.tar.bz2 rails-aa0f95559905e04026e5910876b3bb0d3271e9a4.zip | |
Merge pull request #4419 from j-manu/4255-handle-spaces-in-protocols
Handle leading spaces in protocol while sanitizing
Diffstat (limited to 'actionpack/lib')
| -rw-r--r-- | actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb index af06bffa16..24ffc28710 100644 --- a/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb +++ b/actionpack/lib/action_controller/vendor/html-scanner/html/sanitizer.rb @@ -171,7 +171,7 @@ module HTML def contains_bad_protocols?(attr_name, value) uri_attributes.include?(attr_name) && - (value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase)) + (value =~ /(^[^\/:]*):|(�*58)|(p)|(%|%)3A/ && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip)) end end end |