You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@jspwiki.apache.org by ju...@apache.org on 2026/05/28 17:57:21 UTC
(jspwiki) 01/03: Sanitize link parameter in Image plugin
This is an automated email from the ASF dual-hosted git repository.
juanpablo-santos pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/jspwiki.git
commit c3c87e3ad0f3ff0240c5f794ea553c8ae8d435c2
Author: Juan Pablo Santos RodrÃguez <ju...@gmail.com>
AuthorDate: Thu May 28 19:51:56 2026 +0200
Sanitize link parameter in Image plugin
---
jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
index dbed4dc5a..e3178af89 100644
--- a/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
+++ b/jspwiki-main/src/main/java/org/apache/wiki/plugin/Image.java
@@ -117,7 +117,7 @@ public class Image implements Plugin {
final String wt = getCleanParameter( params, PARAM_WIDTH );
final String alt = getCleanParameter( params, PARAM_ALT );
final String caption = getCleanParameter( params, PARAM_CAPTION );
- final String link = getCleanParameter( params, PARAM_LINK );
+ String link = getCleanParameter( params, PARAM_LINK );
String target = getCleanParameter( params, PARAM_TARGET );
final String style = getCleanParameter( params, PARAM_STYLE );
final String cssclass= getCleanParameter( params, PARAM_CLASS );
@@ -188,6 +188,11 @@ public class Image implements Plugin {
result.append( ">" );
if( link != null ) {
+ if( !context.getBooleanWikiProperty( MarkupParser.PROP_ALLOWHTML, false ) ) {
+ if( link.startsWith( "data:" ) || link.startsWith( "javascript:" ) ) {
+ link = "http://invalid_url" + link;
+ }
+ }
result.append( "<a href=\"" ).append( link ).append( "\"" );
if( target != null ) {
result.append( " target=\"" ).append( target ).append( "\"" );