From f67a174c4a7706a2d419ba3dd43d696104f90696 Mon Sep 17 00:00:00 2001
From: Lauri Ojansivu <x@xet7.org>
Date: Tue, 26 Oct 2021 01:50:28 +0300
Subject: [PATCH] Re-enables custom schemes auto linking.

Thanks to chrisi51 !

Related https://github.com/wekan/wekan/pull/4059
---
 packages/markdown/src/template-integration.js | 64 ++-----------------
 1 file changed, 4 insertions(+), 60 deletions(-)

diff --git a/packages/markdown/src/template-integration.js b/packages/markdown/src/template-integration.js
index fbc64732b..0f4437e74 100755
--- a/packages/markdown/src/template-integration.js
+++ b/packages/markdown/src/template-integration.js
@@ -9,8 +9,6 @@ var Markdown = require('markdown-it')({
 
 import markdownItMermaid from "@wekanteam/markdown-it-mermaid";
 
-/*
-
 // Static URL Scheme Listing
 var urlschemes = [
   "aodroplink",
@@ -23,74 +21,20 @@ var urlschemes = [
   "mailspring"
 ];
 
+
+
 // Better would be a field in the admin backend to set this dynamically
 // instead of putting all known or wanted url schemes here hard into code
 // but i was not able to access those settings
 // var urlschemes = currentSetting.automaticLinkedUrlSchemes.split('\n');
 
+
+
 // put all url schemes into the linkify configuration to automatically make it clickable
 for(var i=0; i<urlschemes.length;i++){
-  //console.log("adding autolink for "+urlschemes[i]);
   Markdown.linkify.add(urlschemes[i]+":",'http:');
 }
 
-
-
-// build fitting regex
-var regex = RegExp('^(' + urlschemes.join('|') + '):', 'gim');
-
-// Add a hook to enforce URI scheme allow-list
-DOMPurify.addHook('afterSanitizeAttributes', function (node) {
-  // build an anchor to map URLs to
-  var anchor = document.createElement('a');
-
-  // check all href attributes for validity
-  if (node.hasAttribute('href')) {
-    anchor.href = node.getAttribute('href');
-    if (anchor.protocol && !anchor.protocol.match(regex)) {
-      node.removeAttribute('href');
-    }
-  }
-  // check all action attributes for validity
-  if (node.hasAttribute('action')) {
-    anchor.href = node.getAttribute('action');
-    if (anchor.protocol && !anchor.protocol.match(regex)) {
-      node.removeAttribute('action');
-    }
-  }
-  // check all xlink:href attributes for validity
-  if (node.hasAttribute('xlink:href')) {
-    anchor.href = node.getAttribute('xlink:href');
-    if (anchor.protocol && !anchor.protocol.match(regex)) {
-      node.removeAttribute('xlink:href');
-    }
-  }
-});
-
-
-// Additional  safeAttrValue function to allow for other specific protocols
-// See https://github.com/leizongmin/js-xss/issues/52#issuecomment-241354114
-function mySafeAttrValue(tag, name, value, cssFilter) {
-  // only when the tag is 'a' and attribute is 'href'
-  // then use your custom function
-  if (tag === 'a' && name === 'href') {
-    // only filter the value if starts with an registered url scheme
-    urlscheme = value.split(/:/);
-    //console.log("validating "+urlscheme[0]);
-    if(urlschemes.includes(urlscheme[0])) return value;
-    else {
-      // use the default safeAttrValue function to process all non cbthunderlinks
-      return sanitizeXss.safeAttrValue(tag, name, value, cssFilter);
-    }
-//  } else if (tag === 'svg') {
-//    return `<img src="data:image/svg+xml;base64,` + atob(value) + `"></img>`;
-  } else {
-    // use the default safeAttrValue function to process it
-    return sanitizeXss.safeAttrValue(tag, name, value, cssFilter);
-  }
-};
-*/
-
 var emoji = require('markdown-it-emoji');
 Markdown.use(emoji);
 Markdown.use(markdownItMermaid);