diff --git a/src/Item.php b/src/Item.php index a8d5a9de1..c60ce4c94 100644 --- a/src/Item.php +++ b/src/Item.php @@ -883,10 +883,13 @@ public function get_links(string $rel = 'alternate') $this->data['links'][$key] = array_unique($this->data['links'][$key]); } - // Apply HTTPS policy to all links + // Apply sanitization and HTTPS policy to all links + $sanitize = $this->get_sanitize(); foreach ($this->data['links'] as &$links) { foreach ($links as &$link) { - $link = $this->get_sanitize()->https_url($link); + $link = ($sanitize->disallowed_uri_schemes !== [] && !$sanitize->is_allowed_scheme($link)) + ? 'unsafe:' . $link + : $sanitize->https_url($link); } } } diff --git a/src/Sanitize.php b/src/Sanitize.php index 18139e256..7ab068046 100644 --- a/src/Sanitize.php +++ b/src/Sanitize.php @@ -764,7 +764,7 @@ protected function enforce_allowed_html_nodes(\DOMNode $element, bool $allow_dat } } - private function is_allowed_scheme(string $uri): bool + public function is_allowed_scheme(string $uri): bool { $pos = strpos($uri, ':'); if ($pos === false) {