File tree Expand file tree Collapse file tree 1 file changed +14
-4
lines changed Expand file tree Collapse file tree 1 file changed +14
-4
lines changed Original file line number Diff line number Diff line change @@ -73,10 +73,20 @@ impl PageLayout<'_> {
7373 /// so that `crossorigin` may be safely removed from `<link>` elements.
7474 fn static_root_path_may_remove_crossorigin ( & self ) -> bool {
7575 let href = & * self . static_root_path ;
76- // Everything up to the first `/`, or the whole str.
77- let first_part = href. split_once ( '/' ) . map_or ( href, |( first, _) | first) ;
78- // Reject protocol-relative URLs (`//example.com/`) or anything with a protocol (`http:`, etc.)
79- !( href. starts_with ( "//" ) || first_part. contains ( ':' ) )
76+ // Reject scheme-relative URLs (`//example.com/`).
77+ if href. starts_with ( "//" ) {
78+ return false ;
79+ }
80+ // URL is interpreted as having a scheme iff: it starts with an ascii alpha, and only
81+ // contains ascii alphanumeric or `+` `-` `.` up to the `:`.
82+ // https://url.spec.whatwg.org/#url-parsing
83+ let has_scheme = href. split_once ( ':' ) . is_some_and ( |( scheme, _rest) | {
84+ let mut chars = scheme. chars ( ) ;
85+ scheme. next ( ) . is_some_and ( |c| c. is_ascii_alphabetic ( ) )
86+ && chars. all ( |c| c. is_ascii_alphanumeric ( ) || c == '+' || c == '-' || c == '.' )
87+ } ) ;
88+ // Reject anything with a scheme (`http:`, etc.).
89+ !has_scheme
8090 }
8191}
8292
You can’t perform that action at this time.
0 commit comments