File tree Expand file tree Collapse file tree 1 file changed +14
-4
lines changed Expand file tree Collapse file tree 1 file changed +14
-4
lines changed Original file line number Diff line number Diff line change @@ -73,10 +73,20 @@ impl PageLayout<'_> {
73
73
/// so that `crossorigin` may be safely removed from `<link>` elements.
74
74
fn static_root_path_may_remove_crossorigin ( & self ) -> bool {
75
75
let href = & * self . static_root_path ;
76
- // Everything up to the first `/`, or the whole str.
77
- let first_part = href. split_once ( '/' ) . map_or ( href, |( first, _) | first) ;
78
- // Reject protocol-relative URLs (`//example.com/`) or anything with a protocol (`http:`, etc.)
79
- !( href. starts_with ( "//" ) || first_part. contains ( ':' ) )
76
+ // Reject scheme-relative URLs (`//example.com/`).
77
+ if href. starts_with ( "//" ) {
78
+ return false ;
79
+ }
80
+ // URL is interpreted as having a scheme iff: it starts with an ascii alpha, and only
81
+ // contains ascii alphanumeric or `+` `-` `.` up to the `:`.
82
+ // https://url.spec.whatwg.org/#url-parsing
83
+ let has_scheme = href. split_once ( ':' ) . is_some_and ( |( scheme, _rest) | {
84
+ let mut chars = scheme. chars ( ) ;
85
+ chars. next ( ) . is_some_and ( |c| c. is_ascii_alphabetic ( ) )
86
+ && chars. all ( |c| c. is_ascii_alphanumeric ( ) || c == '+' || c == '-' || c == '.' )
87
+ } ) ;
88
+ // Reject anything with a scheme (`http:`, etc.).
89
+ !has_scheme
80
90
}
81
91
}
82
92
You can’t perform that action at this time.
0 commit comments