#NEWLINE# def sanitize_url( self , url ) : #NEWLINE# #INDENT# '\n        Sanitize a url against xss attacks in "safe_mode".\n\n        Rather than specifically blacklisting `javascript:alert("XSS")` and all\n        its aliases (see <http://ha.ckers.org/xss.html>), we whitelist known\n        safe url formats. Most urls contain a network location, however some\n        are known not to (i.e.: mailto links). Script urls do not contain a\n        location. Additionally, for `javascript:...`, the scheme would be\n        "javascript" but some aliases will appear to `urlparse()` to have no\n        scheme. On top of that relative links (i.e.: "foo/bar.html") have no\n        scheme. Therefore we must check "path", "parameters", "query" and\n        "fragment" for any literal colons. We don\'t check "scheme" for colons\n        because it *should* never have any and "netloc" must allow the form:\n        `username:password@host:port`.\n\n        ' #NEWLINE# locless_schemes = [ '' , 'mailto' , 'news' ] #NEWLINE# ( scheme , netloc , path , params , query , fragment ) = url = urlparse ( url ) #NEWLINE# safe_url = False #NEWLINE# if ( ( netloc != '' ) or ( scheme in locless_schemes ) ) : #NEWLINE# #INDENT# safe_url = True #NEWLINE# #UNINDENT# for part in url [ 2 : ] : #NEWLINE# #INDENT# if ( ':' in part ) : #NEWLINE# #INDENT# safe_url = False #NEWLINE# #UNINDENT# #UNINDENT# if ( self . markdown . safeMode and ( not safe_url ) ) : #NEWLINE# #INDENT# return '' #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# return urlunparse ( url )