Merge pull request #11 from laszlof/master

Fix XSS vulnerability

jquery.linkify.js

@@ -3,34 +3,33 @@ function linkify(string, buildHashtagUrl, includeW3, target, noFollow) {
   if (noFollow) {
     relNoFollow = " rel=\"nofollow\"";
   }
-
-  string = string.replace(/((http|https|ftp)\:\/\/|\bw{3}\.)[a-z0-9\-\.]+\.[a-z]{2,3}(:[a-z0-9]*)?\/?([a-z\u00C0-\u017F0-9\-\._\?\,\'\/\\\+&%\$#\=~])*/gi, function(captured) {
-    var uri;
-    if (captured.toLowerCase().indexOf("www.") == 0) {
-      if (!includeW3) {
-        return captured;
-      }
-      uri = "http://" + captured;
-    } else {
-      uri = captured;
-    }
-    return "<a href=\"" + uri+ "\" target=\"" + target + "\"" + relNoFollow + ">" + captured + "</a>";
-  });
-
+
+  if (string.toLowerCase().indexOf("www.") === 0 && includeW3) {
+    string = '<a href="http://' + string + '" target="' + target + '"' + relNoFollow + '>' + string + '</a>';
+  } else {
+    string = '<a href="' + string + '" target="' + target + '"' + relNoFollow + '>' + string + '</a>';
+  }
+
   if (buildHashtagUrl) {
-    string = string.replace(/\B#(\w+)/g, "<a href=" + buildHashtagUrl("$1") +" target=\"" + target + "\"" + relNoFollow + ">#$1</a>");
+    string = string.replace(/\B#(\w+)/g, '<a href=' + buildHashtagUrl("$1") + ' target="' + target + '"' + relNoFollow + '>#$1</a>');
   }
   return string;
 }
 
 (function($) {
   $.fn.linkify = function(opts) {
     return this.each(function() {
-      var $this = $(this);
       var buildHashtagUrl;
       var includeW3 = true;
       var target = '_self';
       var noFollow = true;
+      var regex = /((http|https|ftp)\:\/\/|\bw{3}\.)[a-z0-9\-\.]+\.[a-z]{2,3}(:[a-z0-9]*)?\/?([a-z\u00C0-\u017F0-9\-\._\?\,\'\/\\\+&amp;%\$#\=~])*/gi;
+      var txt = this.innerHTML;
+      var output = '';
+      var replacement;
+      var matchLen;
+      var lastIndex = 0;
+
       if (opts) {
         if (typeof opts  == "function") {
           buildHashtagUrl = opts;
@@ -49,18 +48,20 @@ function linkify(string, buildHashtagUrl, includeW3, target, noFollow) {
           }
         }
       }
-      $this.html(
-          $.map(
-            $this.contents(),
-            function(n, i) {
-                if (n.nodeType == 3) {
-                    return linkify(n.data, buildHashtagUrl, includeW3, target, noFollow);
-                } else {
-                    return n.outerHTML;
-                }
-            }
-        ).join("")
-      );
+
+      while ((match = regex.exec(txt)) !== null) {
+        matchLen = match[0].length;
+        replacement = linkify(match[0], buildHashtagUrl, includeW3, target, noFollow);
+        output += txt.substring(lastIndex, match.index + matchLen).replace(match[0], replacement);
+        lastIndex = match.index + matchLen;
+      }
+
+      // Include the rest of the text.
+      if (lastIndex !== txt.length) {
+        output += txt.substring(lastIndex);
+      }
+
+      $(this).html(output);
     });
-  }
-})(jQuery);
+  };
+})(jQuery);