diff options
Diffstat (limited to 'layouts')
| -rw-r--r-- | layouts/_markup/render-image.html | 8 | ||||
| -rw-r--r-- | layouts/_markup/render-link.html | 11 |
2 files changed, 17 insertions, 2 deletions
diff --git a/layouts/_markup/render-image.html b/layouts/_markup/render-image.html index 590c9bf..cd003f3 100644 --- a/layouts/_markup/render-image.html +++ b/layouts/_markup/render-image.html @@ -1 +1,7 @@ -<img src="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} alt="{{ .Text }}" referrerpolicy="no-referrer" loading="lazy">
\ No newline at end of file +{{/* .Destination is marked safe below, so scripting schemes are dropped here */ -}} +{{ $scheme := lower (urls.Parse .Destination).Scheme -}} +{{ if in (slice "javascript" "vbscript") $scheme -}} +{{ warnidf "unsafe-image-scheme" "dropped %s: image in %s" $scheme .Page.Path -}} +{{ else -}} +<img src="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} alt="{{ .Text }}" referrerpolicy="no-referrer" loading="lazy"> +{{- end -}} diff --git a/layouts/_markup/render-link.html b/layouts/_markup/render-link.html index 8fb3c26..bb507d2 100644 --- a/layouts/_markup/render-link.html +++ b/layouts/_markup/render-link.html @@ -1,3 +1,12 @@ {{ $emoji := cond (and (not (.Page.Params.makerefs | default true)) (.Page.Params.showlinkemoji | default true)) (emojify ":link: ") "" -}} {{ $isExternalLink := (urls.Parse .Destination).IsAbs -}} -{{ $emoji }}<a class="link {{ if $isExternalLink }}link--external{{ else }}link--internal{{ end }}" href="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} rel="{{ if $isExternalLink }}external {{ end }}noreferrer">{{ .Text }}</a>
\ No newline at end of file + +{{/* .Destination is marked safe below so that schemes the web knows nothing */ -}} +{{/* about, such as gemini://, survive; scripting schemes are dropped instead */ -}} +{{ $scheme := lower (urls.Parse .Destination).Scheme -}} +{{ if in (slice "javascript" "vbscript" "data") $scheme -}} +{{ warnidf "unsafe-link-scheme" "dropped %s: link in %s" $scheme .Page.Path -}} +{{ .Text -}} +{{ else -}} +{{ $emoji }}<a class="link {{ if $isExternalLink }}link--external{{ else }}link--internal{{ end }}" href="{{ .Destination | safeURL }}"{{ with .Title }} title="{{ . }}"{{ end }} rel="{{ if $isExternalLink }}external {{ end }}noreferrer">{{ .Text }}</a> +{{- end -}} |