Explicitly deny bad URLs.

Fixes #252. Handle embed untrusted links better.
2021-09-25 10:54:32 +01:00
parent 66289911ba
commit 81379d6ec4
5 changed files with 26 additions and 22 deletions
--- a/src/lib/links.ts
+++ b/src/lib/links.ts
@@ -52,7 +52,9 @@ export function determineLink(href?: string): LinkType {
        } catch (err) {}

        if (!internal && url) {
-            return { type: "external", href, url };
+            if (url.protocol !== "javascript") {
+                return { type: "external", href, url };
+            }
        }
    }