Whitelisted known safe url schemes in safe_mode. A better fix for #185.

1 files changed, 7 insertions, 6 deletions

diff --git a/markdown/inlinepatterns.py b/markdown/inlinepatterns.py
index 1ebb310..f64aa58 100644
--- a/markdown/inlinepatterns.py
+++ b/markdown/inlinepatterns.py
@@ -354,19 +354,20 @@ class LinkPattern(Pattern):
             return ''
         
         locless_schemes = ['', 'mailto', 'news']
+        allowed_schemes = locless_schemes + ['http', 'https', 'ftp', 'ftps']
+        if scheme not in allowed_schemes:
+            # Not a known (allowed) scheme. Not safe.
+            return ''
+            
         if netloc == '' and scheme not in locless_schemes:
-            # This fails regardless of anything else. 
-            # Return immediately to save additional proccessing
+            # This should not happen. Treat as suspect.
             return ''
 
         for part in url[2:]:
             if ":" in part:
-                # Not a safe url
+                # A colon in "path", "parameters", "query" or "fragment" is suspect.
                 return ''
 
-        if scheme == 'javascript':
-            return ''
-
         # Url passes all tests. Return url as-is.
         return urlunparse(url)