Erik Michelson 4030cbbd3c fix(renderer): update regex for supported link schemes ...

This commit updates the whitelist we're using for outgoing links from HedgeDoc. Previously, any URI scheme except javascript: could be used as long as it contains two slashes after the scheme (like https://). On the one hand this allowed linking to arbitrary and possibly unsafe URI schemes, on the other hand this breaks some schemes like xmpp: or geo:.
We're now using the list of schemes that can be registered by a browser to be opened. This restricts arbitrary scheme usage but on the other side fixes several other schemes.

Signed-off-by: Erik Michelson <github@erik.michelson.eu>

2025-11-21 21:37:46 +01:00

3.0 KiB

Raw Blame History

View Raw