dualfroz
7f2cd8f154
escapeButPreserveUris() matched any scheme via [A-z]+?://, which also turns javascript://, vbscript:// and data:// URIs into clickable links on the generated error page, allowing script execution on click (XSS). The [A-z] class was also invalid, spanning extra ASCII punctuation. Restrict the scheme to http/https, the only two schemes that make sense to linkify on an error page, leaving other schemes as plain escaped text.