From aed19f01eb701912f480230ed8379642e51d201f Mon Sep 17 00:00:00 2001
From: upstream <upstream@localhost>
Date: Fri, 4 Sep 2026 03:00:40 +0200
Subject: [PATCH] Upstream filp/whoops state of the touched files before
 b6b679db7d

---
 src/Whoops/Util/TemplateHelper.php       |  6 +---
 tests/Whoops/Util/TemplateHelperTest.php | 43 ------------------------
 2 files changed, 1 insertion(+), 48 deletions(-)

diff --git a/src/Whoops/Util/TemplateHelper.php b/src/Whoops/Util/TemplateHelper.php
index c5913eb..5612c0b 100644
--- a/src/Whoops/Util/TemplateHelper.php
+++ b/src/Whoops/Util/TemplateHelper.php
@@ -80,10 +80,6 @@ class TemplateHelper
      * Escapes a string for output in an HTML document, but preserves
      * URIs within it, and converts them to clickable anchor elements.
      *
-     * Only http and https URIs are turned into links. Any other scheme is left as
-     * plain text, because schemes such as javascript: and data: would otherwise
-     * become clickable script execution on the error page.
-     *
      * @param  string $raw
      * @return string
      */
@@ -91,7 +87,7 @@ class TemplateHelper
     {
         $escaped = $this->escape($raw);
         return preg_replace(
-            "@(https?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@i",
+            "@([A-z]+?://([-\w\.]+[-\w])+(:\d+)?(/([\w/_\.#-]*(\?\S+)?[^\.\s])?)?)@",
             "<a href=\"$1\" target=\"_blank\" rel=\"noreferrer noopener\">$1</a>",
             $escaped
         );
diff --git a/tests/Whoops/Util/TemplateHelperTest.php b/tests/Whoops/Util/TemplateHelperTest.php
index 75baf7a..086645a 100644
--- a/tests/Whoops/Util/TemplateHelperTest.php
+++ b/tests/Whoops/Util/TemplateHelperTest.php
@@ -63,49 +63,6 @@ class TemplateHelperTest extends TestCase
         );
     }
 
-    /**
-     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
-     */
-    public function testEscapeButPreserveUrisIgnoresNonHttpSchemes()
-    {
-        // None of these contain HTML special characters, so escaping leaves them
-        // untouched and the only question is whether they get turned into links.
-        $originals = [
-            // Clicking such a link would run alert(1): the browser decodes %0A to a
-            // newline, which ends the "//x.co/?" JavaScript comment.
-            'javascript://x.co/?%0Aalert(1)',
-            'JAVASCRIPT://x.co/?%0Aalert(1)',
-            'vbscript://x.co/?%0Amsgbox(1)',
-            'data://text.html/?%0Ax',
-            // "_" is between "Z" and "a" in ASCII, so it used to pass as a scheme.
-            '_://x.co/a',
-            'See javascript://x.co/?%0Aalert(document.cookie) for details',
-        ];
-
-        foreach ($originals as $original) {
-            $this->assertSame($original, $this->helper->escapeButPreserveUris($original));
-        }
-    }
-
-    /**
-     * @covers Whoops\Util\TemplateHelper::escapeButPreserveUris
-     */
-    public function testEscapeButPreserveUrisStillLinksHttpUris()
-    {
-        $originals = [
-            'http://example.com/a',
-            'https://example.com/a',
-            'HTTPS://example.com/a',
-        ];
-
-        foreach ($originals as $original) {
-            $this->assertSame(
-                "<a href=\"$original\" target=\"_blank\" rel=\"noreferrer noopener\">$original</a>",
-                $this->helper->escapeButPreserveUris($original)
-            );
-        }
-    }
-
     /**
      * @covers Whoops\Util\TemplateHelper::breakOnDelimiter
      */