bleedingdeacons / register / 37157728583

49%

push

github

fix: only link markdown to http, https and mailto targets (#52)

BasicMarkdownConverter escaped HTML before building links, so a quote
could not break out of the href, but it put any target into one:
[x](javascript:alert(1)) became a live javascript: link. A target is now
linked only when it is an absolute http, https or mailto URI whose raw
text begins with that scheme; anything else (javascript:, data:,
vbscript:, a relative path) is rendered as the link text alone.

7 of 7 new or added lines in 1 file covered. (100.0%)

2119 of 4284 relevant lines covered (49.46%)

4.26 hits per line