fix: ignore javascript: & mailto:

hexojs · Oct 27, 2019 · 1df133b · 1df133b
1 parent b1cd88a
commit 1df133b
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 3 deletions.
diff --git a/lib/filter.js b/lib/filter.js
@@ -34,7 +34,7 @@ module.exports = function(data) {
     const noFollow = 'external nofollow noreferrer';
 
     return data.replace(/<a.*?(href=['"](.*?)['"]).*?>/gi, (str, hrefStr, href) => {
-      if (!isExternal(href, config)) return str;
+      if (href.startsWith('mailto:') || href.startsWith('javascript:') || !isExternal(href, config)) return str;
 
       if (/rel=/gi.test(str)) {
         return str.replace(/rel="(.*?)"/gi, (relStr, rel) => {

diff --git a/test/index.js b/test/index.js
@@ -76,7 +76,11 @@ describe('hexo-filter-nofollow', () => {
       '5. Internal link',
       '<a href="/archives/foo.html">Link</a>',
       '6. Ignore links don\'t have "href" attribute',
-      '<a>Anchor</a>'
+      '<a>Anchor</a>',
+      '7. Link with hash (#), mailto: , javascript: shouldn\'t be processed',
+      '<a href="#top">Hexo</a>',
+      '<a href="mailto:[email protected]">Hexo</a>',
+      '<a href="javascript:alert(\'Hexo is awesome!\');">Hexo</a>'
     ].join('\n');
 
     hexo.config.nofollow.field = 'post';
@@ -102,7 +106,11 @@ describe('hexo-filter-nofollow', () => {
       '5. Internal link',
       '<a href="/archives/foo.html">Link</a>',
       '6. Ignore links don\'t have "href" attribute',
-      '<a>Anchor</a>'
+      '<a>Anchor</a>',
+      '7. Link with hash (#), mailto: , javascript: shouldn\'t be processed',
+      '<a href="#top">Hexo</a>',
+      '<a href="mailto:[email protected]">Hexo</a>',
+      '<a href="javascript:alert(\'Hexo is awesome!\');">Hexo</a>'
     ].join('\n'));
 
     hexo.config.nofollow.field = 'site';