Fix XSS with iframe url starts with spaces

8 years ago · b5fc7b92b9
1 changed files with 2 additions and 2 deletions
--- a/utility.js
+++ b/utility.js
@ -100,11 +100,11 @@ module.exports = {
          $(elem).attr('style', cssfilter.process($(elem).attr('style')));
        }

-        if ($(elem).attr('href') && $(elem).attr('href').startsWith('javascript:')) {
+        if ($(elem).attr('href') && $(elem).attr('href').trim().toLowerCase().startsWith('javascript:')) {
          $(elem).attr('href', '');
        }

-        if ($(elem).attr('src') && $(elem).attr('src').startsWith('javascript:')) {
+        if ($(elem).attr('src') && $(elem).attr('src').trim().toLowerCase().startsWith('javascript:')) {
          $(elem).attr('src', '');
        }
      });