blacklist x-schema protocol

YahooArchive · Jul 14, 2015 · a0e38b3 · a0e38b3
1 parent 4cdd9b8
commit a0e38b3
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/xss-filters.js b/src/xss-filters.js
@@ -45,7 +45,7 @@ exports._getPrivFilters = function () {
     // Reference: http://shazzer.co.uk/database/All/Characters-after-javascript-uri
     // Reference: https://html.spec.whatwg.org/multipage/syntax.html#consume-a-character-reference
     // Reference for named characters: https://html.spec.whatwg.org/multipage/entities.json
-    var URI_BLACKLIST_PROTOCOLS = {'javascript':1, 'data':1, 'vbscript':1, 'mhtml':1},
+    var URI_BLACKLIST_PROTOCOLS = {'javascript':1, 'data':1, 'vbscript':1, 'mhtml':1, 'x-schema':1},
         URI_PROTOCOL_COLON = /(?::|&#[xX]0*3[aA];?|&#0*58;?|&colon;)/,
         URI_PROTOCOL_WHITESPACES = /(?:^[\x00-\x20]+|[\t\n\r\x00]+)/g,
         URI_PROTOCOL_NAMED_REF_MAP = {Tab: '\t', NewLine: '\n'};