commit:bea3e3c083a638dfd2e0e8b95e10731a34b0fe4f
author:Chip Black
committer:Chip Black
date:Wed Jan 12 23:36:58 2011 -0800
parents:2a252001cf9fbb3b5459d142b340a02b5c6eaaa9
Fix scripting vulnerability in regex parsing (thanks zx2c4)
diff --git a/www/js/blerg.js b/www/js/blerg.js
line changes: +2/-2
index c5fd504..dcb5679
--- a/www/js/blerg.js
+++ b/www/js/blerg.js
@@ -247,10 +247,10 @@ function mangleRecord(record, template) {
     record.data = record.data.replace('&', '&amp;').replace('<', '&lt;').replace('>', '&gt');
 
     // Turn HTTP URLs into links
-    record.data = record.data.replace(/(\s|^)(https?:\/\/[a-zA-Z0-9.-]*[a-zA-Z0-9](\/(\S*[^.!,;?()\s])?)?)/g, '$1<a href="$2">$2</a>');
+    record.data = record.data.replace(/(\s|^)(https?:\/\/[a-zA-Z0-9.-]*[a-zA-Z0-9](\/([^\s"]*[^.!,;?()\s])?)?)/g, '$1<a href="$2">$2</a>');
 
     // Turn markdown links into links
-    record.data = record.data.replace(/(\s|^)\[([^\]]+)\]\((https?:\/\/[a-zA-Z0-9.-]*[a-zA-Z0-9](\/[^)]*?)?)\)/, '$1<a href="$3">$2</a>');
+    record.data = record.data.replace(/(\s|^)\[([^\]]+)\]\((https?:\/\/[a-zA-Z0-9.-]*[a-zA-Z0-9](\/[^)"]*?)?)\)/, '$1<a href="$3">$2</a>');
 
     // Turn *foo* into italics and **foo** into bold
     record.data = record.data.replace(/(\s)\*\*([^*]+)\*\*(\s)/, '$1<b>$2</b>$3');