geckon01/whoops
1
0
Fork 0
mirror of https://github.com/filp/whoops.git synced 2026-09-16 04:36:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Prevent possible XSS via target="_blank" urls (#533)

Browse Source
This commit is contained in:
Markus Staab
2017-10-10 12:00:26 +02:00
committed by Denis Sokolov
parent a50d24d81a
commit 9e7c2ea58c
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/Whoops/Util/TemplateHelper.php
+1 -1
View File
@@ -88,7 +88,7 @@ class TemplateHelper
$escaped = $this->escape($raw);
return preg_replace(
"@([A-z]+?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@",
"<a href=\"$1\" target=\"_blank\">$1</a>",
"<a href=\"$1\" target=\"_blank\" rel=\"noreferrer noopener\">$1</a>",
$escaped
);
}
tests/Whoops/Util/TemplateHelperTest.php
+1 -1
View File
@@ -59,7 +59,7 @@ class TemplateHelperTest extends TestCase
$this->assertEquals(
$this->helper->escapeButPreserveUris($original),
"This is a &lt;a href=&#039;&#039;&gt;<a href=\"http://google.com\" target=\"_blank\">http://google.com</a>&lt;/a&gt; test string"
"This is a &lt;a href=&#039;&#039;&gt;<a href=\"http://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">http://google.com</a>&lt;/a&gt; test string"
);
}