diff --git a/src/Whoops/Util/TemplateHelper.php b/src/Whoops/Util/TemplateHelper.php index b77b160..5612c0b 100644 --- a/src/Whoops/Util/TemplateHelper.php +++ b/src/Whoops/Util/TemplateHelper.php @@ -80,9 +80,6 @@ class TemplateHelper * Escapes a string for output in an HTML document, but preserves * URIs within it, and converts them to clickable anchor elements. * - * Only http and https URIs are linkified; other schemes are left as - * plain escaped text so that a link cannot execute script when clicked. - * * @param string $raw * @return string */ @@ -90,7 +87,7 @@ class TemplateHelper { $escaped = $this->escape($raw); return preg_replace( - "@(https?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@i", + "@([A-z]+?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@", "$1", $escaped ); diff --git a/tests/Whoops/Util/TemplateHelperTest.php b/tests/Whoops/Util/TemplateHelperTest.php index 100b463..086645a 100644 --- a/tests/Whoops/Util/TemplateHelperTest.php +++ b/tests/Whoops/Util/TemplateHelperTest.php @@ -63,44 +63,6 @@ class TemplateHelperTest extends TestCase ); } - /** - * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris - */ - public function testEscapeButPreserveUrisRejectsDangerousSchemes() - { - $dangerous = [ - 'javascript://x.co/?%0Aalert(1)', - 'vbscript://x.co/?%0Amsgbox(1)', - 'data://text/html,', - ]; - - foreach ($dangerous as $payload) { - $output = $this->helper->escapeButPreserveUris($payload); - - $this->assertStringNotContainsString( - 'assertEquals( - "http://google.com", - $this->helper->escapeButPreserveUris('http://google.com') - ); - - $this->assertEquals( - "https://google.com", - $this->helper->escapeButPreserveUris('https://google.com') - ); - } - /** * @covers Whoops\Util\TemplateHelper::breakOnDelimiter */