diff --git a/js/privatebin.js b/js/privatebin.js
index 139ecc73..7dc8b4ef 100644
--- a/js/privatebin.js
+++ b/js/privatebin.js
@@ -392,7 +392,7 @@ jQuery.PrivateBin = (function($, RawDeflate) {
me.urls2links = function(html)
{
return html.replace(
- /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]*>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig,
+ /(((https?|ftp):\/\/[\w?!=&.\/-;#@~%+*-]+(?![\w\s?!&.\/;#~%"=-]>))|((magnet):[\w?=&.\/-;#@~%+*-]+))/ig,
'$1'
);
};
@@ -2504,6 +2504,14 @@ jQuery.PrivateBin = (function($, RawDeflate) {
return;
}
+ // encode < to make sure DomPurify does not interpret e.g. HTML or XML markup as code
+ // cf. https://developer.mozilla.org/en-US/docs/Web/HTML/Element/xmp#Summary
+ // As Markdown, by definition, is/allows HTML code, we do not do anything there.
+ if (format !== 'markdown') {
+ // one character is enough, as this is not security-relevant (all output will go through DOMPurify later)
+ text = text.replace(/
-
+
-
+
-
+
-
-
-
-
+
+
+
+
-
+
-
+
-
-
-
+
+
+
diff --git a/tpl/page.php b/tpl/page.php
index 171f997f..7ffbe946 100644
--- a/tpl/page.php
+++ b/tpl/page.php
@@ -20,37 +20,37 @@ if ($SYNTAXHIGHLIGHTING):
endif;
endif;
?>
-
+
-
+
-
+
-
-
-
+
+
+
-
+
-
+
-
-
-
+
+
+