Forbid javascript: URLs for url data type

(omeka#1688)
Daniel-KM · Feb 10, 2021 · 442e395 · 442e395
1 parent ca4052c
commit 442e395
Showing 1 changed file with 8 additions and 5 deletions.
diff --git a/application/src/DataType/Uri.php b/application/src/DataType/Uri.php
@@ -25,13 +25,16 @@ public function form(PhpRenderer $view)
 
  public function isValid(array $valueObject)
  {
- if (isset($valueObject['@id'])
- && is_string($valueObject['@id'])
- && '' !== trim($valueObject['@id'])
+ if (!isset($valueObject['@id'])
+ || !is_string($valueObject['@id'])
  ) {
- return true;
+ return false;
  }
- return false;
+
+ $trimmed = trim($valueObject['@id']);
+ $scheme = parse_url($trimmed, \PHP_URL_SCHEME);
+
+ return !('' === $trimmed || $scheme === 'javascript');
  }
 
  public function hydrate(array $valueObject, Value $value, AbstractEntityAdapter $adapter)