Solo permitir URLs web al sanitizar

fixes #2382
2021-08-11 10:25:05 -03:00 · 2021-08-11 10:25:05 -03:00 · 0bd8a2243e
commit 0bd8a2243e
parent 312df05a84
1 changed files with 1 additions and 1 deletions
--- a/app/models/metadata_content.rb
+++ b/app/models/metadata_content.rb
@ -56,7 +56,7 @@ class MetadataContent < MetadataTemplate
        uri = URI element['src']

        # No permitimos recursos externos
-        element.remove unless uri.hostname.end_with? Site.domain
+        element.remove unless uri.scheme == 'https' && uri.hostname.end_with?(Site.domain)
      rescue URI::Error
        element.remove
      end