Remove href attribute if it executes JavaScript.

[tt-rss.git] / include / functions2.php

diff --git a/include/functions2.php b/include/functions2.php
index aab73d34291f61ab4ca903723734623fdfe6e947..dceea507ee882ccbc6f15935c1a959ad7795ad26 100644 (file)
--- a/include/functions2.php
+++ b/include/functions2.php
@@ -1064,6 +1064,10 @@
                                                array_push($attrs_to_remove, $attr);
                                        }
 
+                                       if ($attr->nodeName == 'href' && stripos($attr->value, 'javascript:') === 0) {
+                                               array_push($attrs_to_remove, $attr);
+                                       }
+
                                        if (in_array($attr->nodeName, $disallowed_attributes)) {
                                                array_push($attrs_to_remove, $attr);
                                        }