Upstream filp/whoops state of the touched files before 4a1b06f129

src/Whoops/Util/TemplateHelper.php

@@ -80,9 +80,6 @@ class TemplateHelper
      * Escapes a string for output in an HTML document, but preserves
      * URIs within it, and converts them to clickable anchor elements.
      *
-     * Only http and https URIs are linkified; other schemes are left as
-     * plain escaped text so that a link cannot execute script when clicked.
-     *
      * @param  string $raw
      * @return string
      */
@@ -90,7 +87,7 @@ class TemplateHelper
     {
         $escaped = $this->escape($raw);
         return preg_replace(
-            "@(https?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@i",
+            "@([A-z]+?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@",
             "<a href=\"$1\" target=\"_blank\" rel=\"noreferrer noopener\">$1</a>",
             $escaped
         );

tests/Whoops/Util/TemplateHelperTest.php

@@ -63,44 +63,6 @@ class TemplateHelperTest extends TestCase
         );
     }
 
-    /**
-     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
-     */
-    public function testEscapeButPreserveUrisRejectsDangerousSchemes()
-    {
-        $dangerous = [
-            'javascript://x.co/?%0Aalert(1)',
-            'vbscript://x.co/?%0Amsgbox(1)',
-            'data://text/html,<script>alert(1)</script>',
-        ];
-
-        foreach ($dangerous as $payload) {
-            $output = $this->helper->escapeButPreserveUris($payload);
-
-            $this->assertStringNotContainsString(
-                '<a href=',
-                $output,
-                "Payload '$payload' must not be turned into a clickable link"
-            );
-        }
-    }
-
-    /**
-     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
-     */
-    public function testEscapeButPreserveUrisAllowsHttpAndHttpsSchemes()
-    {
-        $this->assertEquals(
-            "<a href=\"http://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">http://google.com</a>",
-            $this->helper->escapeButPreserveUris('http://google.com')
-        );
-
-        $this->assertEquals(
-            "<a href=\"https://google.com\" target=\"_blank\" rel=\"noreferrer noopener\">https://google.com</a>",
-            $this->helper->escapeButPreserveUris('https://google.com')
-        );
-    }
-
     /**
      * @covers Whoops\Util\TemplateHelper::breakOnDelimiter
      */