From 52e5db4f9e38fc5f09fd5de611a44748fc90159a Mon Sep 17 00:00:00 2001
From: Wolfy0615 <45273698+Wolfy0615@users.noreply.github.com>
Date: Tue, 13 Sep 2022 00:03:48 -0400
Subject: [PATCH] Fix linky shenanigans

---
 client/script.js | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/client/script.js b/client/script.js
index b3ead7d..4c4562d 100644
--- a/client/script.js
+++ b/client/script.js
@@ -21,15 +21,30 @@ $(function () {
   
   function setupMarkdown() {
     var renderer = new marked.Renderer();
-    renderer.link = function(href, title, text) {
-      var link = marked.Renderer.prototype.link.apply(this, arguments);
-      return link.replace("<a","<a target='_blank'");
-    };
     renderer.image = function (text) {
       return text;
     };
-    renderer.link = function (text) {
-      return text;
+    renderer.link = function (href, title, text) {
+        if (this.options.sanitize) {
+            try {
+                let prot = decodeURIComponent(unescape(href))
+                    .replace(/[^\w:]/g, "")
+                    .toLowerCase();
+
+                if (prot.indexOf("javascript:") === 0 || prot.indexOf("vbscript:") === 0 || prot.indexOf("data:") === 0) {
+                    return "";
+                }
+            } catch (e) {
+                return "";
+            }
+        }
+
+        // Only interpret links that contain a protocol
+        if (!text.startsWith("http://") && !text.startsWith("https://")) {
+            return text;
+        }
+
+        return `<a href="${ href }" target="_blank">${ text }</a>`;
     };
     marked.setOptions({
       renderer: renderer