diff --git a/browser/lib/markdown-it-sanitize-html.js b/browser/lib/markdown-it-sanitize-html.js index 9bdd3034..ce6c5e29 100644 --- a/browser/lib/markdown-it-sanitize-html.js +++ b/browser/lib/markdown-it-sanitize-html.js @@ -37,8 +37,8 @@ module.exports = function sanitizePlugin (md, options) { }) } -const tagRegex = /<([A-Z][A-Z0-9]*)\s*((?:\s*[A-Z][A-Z0-9]*(?:="(?:[^\"]+)\")?)*)\s*\/?>|<\/([A-Z][A-Z0-9]*)\s*>/i -const attributesRegex = /([A-Z][A-Z0-9]*)(="[^\"]+\")?/ig +const tagRegex = /<([A-Z][A-Z0-9]*)\s*((?:\s*[A-Z][A-Z0-9]*(?:=("|')(?:[^\3]+?)\3)?)*)\s*\/?>|<\/([A-Z][A-Z0-9]*)\s*>/i +const attributesRegex = /([A-Z][A-Z0-9]*)(?:=("|')([^\2]+?)\2)?/ig function sanitizeInline (html, options) { let match = tagRegex.exec(html) @@ -63,7 +63,7 @@ function sanitizeInline (html, options) { while ((match = attributesRegex.exec(attributes))) { name = match[1].toLowerCase() - value = match[2] + value = match[3] if (allowedAttributes['*'].indexOf(name) !== -1 || (allowedAttributes[tag] && allowedAttributes[tag].indexOf(name) !== -1)) { if (allowedSchemesAppliedToAttributes.indexOf(name) !== -1) { @@ -72,7 +72,10 @@ function sanitizeInline (html, options) { } } - attrs += ` ${name}${value}` + attrs += ` ${name}` + if (match[2]) { + attrs += `="${value}"` + } } } @@ -83,7 +86,7 @@ function sanitizeInline (html, options) { } } else { // closing tag - if (allowedTags.indexOf(match[3].toLowerCase()) !== -1) { + if (allowedTags.indexOf(match[4].toLowerCase()) !== -1) { return html } else { return ''