Allow geo: scheme in (description) links

Fix #1140
This commit is contained in:
David Larlet 2023-06-14 12:56:32 -04:00
parent 186480ea01
commit 4fca2cccca
No known key found for this signature in database
GPG key ID: 3E2953A359E7E7BD

View file

@ -64,6 +64,12 @@ L.Util.escapeHTML = (s) => {
],
ADD_ATTR: ['target', 'allow', 'allowfullscreen', 'frameborder', 'scrolling'],
ALLOWED_ATTR: ['href', 'src', 'width', 'height'],
// Added: `geo:` URL scheme as defined in RFC5870:
// https://www.rfc-editor.org/rfc/rfc5870.html
// The base RegExp comes from:
// https://github.com/cure53/DOMPurify/blob/main/src/regexp.js#L10
ALLOWED_URI_REGEXP:
/^(?:(?:(?:f|ht)tps?|mailto|tel|callto|sms|cid|xmpp|geo):|[^a-z]|[a-z+.\-]+(?:[^a-z+.\-:]|$))/i,
})
return s
}