diff options
Diffstat (limited to 'layouts/_markup/render-image.html')
| -rw-r--r-- | layouts/_markup/render-image.html | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/layouts/_markup/render-image.html b/layouts/_markup/render-image.html index 590c9bf..cd003f3 100644 --- a/layouts/_markup/render-image.html +++ b/layouts/_markup/render-image.html @@ -1 +1,7 @@ -<img src="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} alt="{{ .Text }}" referrerpolicy="no-referrer" loading="lazy">
\ No newline at end of file +{{/* .Destination is marked safe below, so scripting schemes are dropped here */ -}} +{{ $scheme := lower (urls.Parse .Destination).Scheme -}} +{{ if in (slice "javascript" "vbscript") $scheme -}} +{{ warnidf "unsafe-image-scheme" "dropped %s: image in %s" $scheme .Page.Path -}} +{{ else -}} +<img src="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} alt="{{ .Text }}" referrerpolicy="no-referrer" loading="lazy"> +{{- end -}} |