Do not prefix href of select2 with unsafe to avoid #504

Signed-off-by: Julius Härtl <[email protected]>
nextcloud · Jun 28, 2018 · dc5fbbf · dc5fbbf
1 parent bfe7190
commit dc5fbbf
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/js/app/Config.js b/js/app/Config.js
@@ -33,6 +33,9 @@ app.config(function ($provide, $interpolateProvider, $httpProvider, $urlRouterPr
 
 
 	$compileProvider.debugInfoEnabled(true);
+	// This should fix adding "unsafe:" prefix to ui-select href links containing javascript
+	// inline JS is blocked by CSP anyway and filtered out by our markdown renderer as well
+	$compileProvider.aHrefSanitizationWhitelist(/^\s*(https?|javascript):/);
 
 	markdownItConverterProvider.use(markdownitLinkTarget, {
 		breaks: true,