From ea60d5a2056aa5d16c9184a85d2d50d27a9f77e9 Mon Sep 17 00:00:00 2001
From: Christian Hillebrand <github@webxass.de>
Date: Wed, 20 Oct 2021 12:35:01 +0200
Subject: [PATCH] Re-enables custom schemes auto linking

---
 packages/markdown/src/template-integration.js | 42 ++++++++++++++++++-
 releases/delete-phantomjs.sh                  |  3 --
 2 files changed, 41 insertions(+), 4 deletions(-)
 delete mode 100755 releases/delete-phantomjs.sh

diff --git a/packages/markdown/src/template-integration.js b/packages/markdown/src/template-integration.js
index 1e12ae794..a5e8ac720 100755
--- a/packages/markdown/src/template-integration.js
+++ b/packages/markdown/src/template-integration.js
@@ -9,7 +9,7 @@ var Markdown = require('markdown-it')({
 
 import markdownItMermaid from "@liradb2000/markdown-it-mermaid";
 
-/*
+
 // Static URL Scheme Listing
 var urlschemes = [
   "aodroplink",
@@ -22,6 +22,10 @@ var urlschemes = [
   "mailspring"
 ];
 
+
+
+
+
 // Better would be a field in the admin backend to set this dynamically
 // instead of putting all known or wanted url schemes here hard into code
 // but i was not able to access those settings
@@ -33,6 +37,42 @@ for(var i=0; i<urlschemes.length;i++){
   Markdown.linkify.add(urlschemes[i]+":",'http:');
 }
 
+
+// build fitting regex
+var regex = RegExp('^(' + urlschemes.join('|') + '):', 'gim');
+
+// Add a hook to enforce URI scheme allow-list
+DOMPurify.addHook('afterSanitizeAttributes', function (node) {
+  // build an anchor to map URLs to
+  var anchor = document.createElement('a');
+
+  // check all href attributes for validity
+  if (node.hasAttribute('href')) {
+    anchor.href = node.getAttribute('href');
+    if (anchor.protocol && !anchor.protocol.match(regex)) {
+      node.removeAttribute('href');
+    }
+  }
+  // check all action attributes for validity
+  if (node.hasAttribute('action')) {
+    anchor.href = node.getAttribute('action');
+    if (anchor.protocol && !anchor.protocol.match(regex)) {
+      node.removeAttribute('action');
+    }
+  }
+  // check all xlink:href attributes for validity
+  if (node.hasAttribute('xlink:href')) {
+    anchor.href = node.getAttribute('xlink:href');
+    if (anchor.protocol && !anchor.protocol.match(regex)) {
+      node.removeAttribute('xlink:href');
+    }
+  }
+});
+
+
+
+
+/*
 // Additional  safeAttrValue function to allow for other specific protocols
 // See https://github.com/leizongmin/js-xss/issues/52#issuecomment-241354114
 function mySafeAttrValue(tag, name, value, cssFilter) {
diff --git a/releases/delete-phantomjs.sh b/releases/delete-phantomjs.sh
deleted file mode 100755
index 5fb85e10c..000000000
--- a/releases/delete-phantomjs.sh
+++ /dev/null
@@ -1,3 +0,0 @@
-cd ~/repos/wekan/.build
-find . -name "*phantomjs*" | xargs rm -rf
-cd ~/repos/wekan