dualfroz
8652196c72
escapeButPreserveUris() matched the scheme with "[A-z]+?://", which accepts any scheme. A frame comment containing javascript://x.co/?%0Aalert(1) survives htmlspecialchars() untouched and was then wrapped in an anchor, so clicking it executed script in the origin of the error page. "[A-z]" is also a code point range rather than a letter class, so it additionally matched the six characters between "Z" and "a", making "_://x.co/a" a link too. Match the scheme with "https?" instead, case-insensitively so uppercase "HTTP://" keeps working. Other schemes stay as escaped plain text. The editor integration links are not affected, they are emitted directly by the template and never pass through this method. Fixes #791