diff --git a/Parsedown.php b/Parsedown.php index c540d12..110d6e3 100644 --- a/Parsedown.php +++ b/Parsedown.php @@ -1554,14 +1554,7 @@ class Parsedown } } - $Element['attributes'][$attribute] = preg_replace_callback( - '/[^\/#?&=%]++/', - function (array $match) - { - return urlencode($match[0]); - }, - $Element['attributes'][$attribute] - ); + $Element['attributes'][$attribute] = str_replace(':', '%3A', $Element['attributes'][$attribute]); return $Element; } diff --git a/test/data/xss_bad_url.html b/test/data/xss_bad_url.html index 8e43877..0b216d1 100644 --- a/test/data/xss_bad_url.html +++ b/test/data/xss_bad_url.html @@ -1,16 +1,16 @@ -

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

-

xss

\ No newline at end of file +

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

+

xss

\ No newline at end of file