diff options
Diffstat (limited to 'layouts/_markup/render-link.html')
| -rw-r--r-- | layouts/_markup/render-link.html | 11 |
1 files changed, 10 insertions, 1 deletions
diff --git a/layouts/_markup/render-link.html b/layouts/_markup/render-link.html index 8fb3c26..bb507d2 100644 --- a/layouts/_markup/render-link.html +++ b/layouts/_markup/render-link.html @@ -1,3 +1,12 @@ {{ $emoji := cond (and (not (.Page.Params.makerefs | default true)) (.Page.Params.showlinkemoji | default true)) (emojify ":link: ") "" -}} {{ $isExternalLink := (urls.Parse .Destination).IsAbs -}} -{{ $emoji }}<a class="link {{ if $isExternalLink }}link--external{{ else }}link--internal{{ end }}" href="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} rel="{{ if $isExternalLink }}external {{ end }}noreferrer">{{ .Text }}</a>
\ No newline at end of file + +{{/* .Destination is marked safe below so that schemes the web knows nothing */ -}} +{{/* about, such as gemini://, survive; scripting schemes are dropped instead */ -}} +{{ $scheme := lower (urls.Parse .Destination).Scheme -}} +{{ if in (slice "javascript" "vbscript" "data") $scheme -}} +{{ warnidf "unsafe-link-scheme" "dropped %s: link in %s" $scheme .Page.Path -}} +{{ .Text -}} +{{ else -}} +{{ $emoji }}<a class="link {{ if $isExternalLink }}link--external{{ else }}link--internal{{ end }}" href="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} rel="{{ if $isExternalLink }}external {{ end }}noreferrer">{{ .Text }}</a> +{{- end -}} |