X-Git-Url: https://sipb.mit.edu/gitweb.cgi/ikiwiki.git/blobdiff_plain/3cda22a27fafc5cdfdd32ddc0644242f61410ce7..279db7860dc98bedbd8333bb7de57251dcfb223d:/IkiWiki/Plugin/htmlscrubber.pm

diff --git a/IkiWiki/Plugin/htmlscrubber.pm b/IkiWiki/Plugin/htmlscrubber.pm
index 53d4635d5..3bdaccea1 100644
--- a/IkiWiki/Plugin/htmlscrubber.pm
+++ b/IkiWiki/Plugin/htmlscrubber.pm
@@ -15,23 +15,23 @@ sub import { #{{{
 	# Only known uri schemes are allowed to avoid all the ways of
 	# embedding javascrpt.
 	# List at http://en.wikipedia.org/wiki/URI_scheme
-	my $uri_schemes=join("|",
+	my $uri_schemes=join("|", map quotemeta,
 		# IANA registered schemes
 		"http", "https", "ftp", "mailto", "file", "telnet", "gopher",
 		"aaa", "aaas", "acap", 	"cap", "cid", "crid", 
 		"dav", "dict", "dns", "fax", "go", "h323", "im", "imap",
 		"ldap", "mid", "news", "nfs", "nntp", "pop", "pres",
 		"sip", "sips", "snmp", "tel", "urn", "wais", "xmpp",
-		"z39\.50r", "z39\.50s",
+		"z39.50r", "z39.50s",
 		# Selected unofficial schemes
 		"aim", "callto", "cvs", "ed2k", "feed", "fish", "gg",
 		"irc", "ircs", "lastfm", "ldaps", "magnet", "mms",
 		"msnim", "notes", "rsync", "secondlife", "skype", "ssh",
-		"sftp", "sms", "steam", "webcal", "ymsgr",
+		"sftp", "smb", "sms", "snews", "webcal", "ymsgr",
 	);
 	# data is a special case. Allow data:image/*, but
 	# disallow data:text/javascript and everything else.
-	$safe_url_regexp=qr/^(?:(?:$uri_schemes):|data:image\/|[^:]+$)/i;
+	$safe_url_regexp=qr/^(?:(?:$uri_schemes):|data:image\/|[^:]+(?:$|\/))/i;
 } # }}}
 
 sub sanitize (@) { #{{{