From 55d25b721fe4485dc4d2d393eae1740d27e3e4c4 Mon Sep 17 00:00:00 2001
From: ccd0 <admin@containerchan.org>
Date: Mon, 30 Jun 2014 02:11:47 -0700
Subject: [PATCH] test sauce link protocols against whitelist

---
 src/Images/Sauce.coffee | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/src/Images/Sauce.coffee b/src/Images/Sauce.coffee
index 7af279766..01b040398 100755
--- a/src/Images/Sauce.coffee
+++ b/src/Images/Sauce.coffee
@@ -39,13 +39,13 @@ Sauce =
         else
           type
     ext = post.file.URL.match(/\.([^\.]*)$/)?[1] or ''
-    if (!parts['boards'] or post.board.ID in parts['boards'].split ',') and (!parts['types'] or ext in parts['types'].split ',')
-      a = Sauce.link.cloneNode true
-      a.href = parts['url']
-      a.textContent = parts['text']
-      a
-    else
-      null
+    return null unless !parts['boards'] or post.board.ID in parts['boards'].split ','
+    return null unless !parts['types']  or ext           in parts['types'].split ','
+    a = Sauce.link.cloneNode true
+    a.href = parts['url']
+    a.textContent = parts['text']
+    return null unless /^https?:$/.test a.protocol
+    a
   node: ->
     return if @isClone or !@file
     nodes = []