Merge branch 'hotfix/31-xss-bypass'

darylldoyle · Oct 21, 2019 · 51ca4b7 · 51ca4b7 · larowlan · Oct 28, 2019
2 parents 83f1bbc + 38767c1
commit 51ca4b7
Show file tree

Hide file tree

Showing 3 changed files with 5 additions and 1 deletion.
diff --git a/src/Sanitizer.php b/src/Sanitizer.php
@@ -21,7 +21,7 @@ class Sanitizer
     /**
      * Regex to catch script and data values in attributes
      */
-    const SCRIPT_REGEX = '/(?:\w+script|data):/xi';
+    const SCRIPT_REGEX = '/(?:\w+script|data)(?:\s)?:/xi';
 
     /**
      * @var \DOMDocument

diff --git a/tests/data/hrefCleanOne.svg b/tests/data/hrefCleanOne.svg
diff --git a/tests/data/hrefTestOne.svg b/tests/data/hrefTestOne.svg