michelf/php-markdown — pull request #156 by iamcal (2014-03-02 04:06:58+00:00)
Title: Allow strong filtering of linked URLs

Currently, apps using this library for turning user-entered Markdown into HTML are vulnerable to XSS attacks via allowing javascript (and others) as the protocol for links. For example:

[CLICK ME](javascript:alert(document.cookie))

This PR passes all link URLs through the `filterUrl()` method. By default, this function will allow through URls using a whitelist of protocols, or local/relative URLs without a protocol. There is some heavy decoding involved to make sure URLs like `javascript%3Aalert(document.cookie)` don't slip through.

This change breaks two tests in the current suite ("Links, inline style" & "Quotes in attributes") since they both involve putting broken URLs inside links. Changing the test to have URLs prefixed with `http://` makes these test pass correctly.