blallo/tt-rss
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Remove href attribute if it executes JavaScript.

Browse source
This commit is contained in:
JustAMacUser 2016-08-06 14:07:30 -04:00
parent 4800746386
commit d8b0f06705
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
include/functions2.php
View file

@ -1064,6 +1064,10 @@
array_push($attrs_to_remove, $attr); array_push($attrs_to_remove, $attr);
} }
if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
array_push($attrs_to_remove, $attr);
}
if (in_array($attr->nodeName, $disallowed_attributes)) { if (in_array($attr->nodeName, $disallowed_attributes)) {
array_push($attrs_to_remove, $attr); array_push($attrs_to_remove, $attr);
} }