ad_html_security_check_protocol (private)

 ad_html_security_check_protocol [ -attr_name attr_name ] \
    [ -attr_value attr_value ] \
    [ -allowed_protocols allowed_protocols ]

Defined in packages/acs-tcl/tcl/text-html-procs.tcl

Check for allowed protocol in attribute value

Switches:

-attr_name

(optional)

-attr_value

(optional)

-allowed_protocols

(optional)

Partial Call Graph (max 5 caller/called nodes):

Testcases:

No testcase defined.

Source code:

        if { [regexp {^\s*(([^\s:]+):\/\/|(data|javascript|blob):)} $attr_value match . p1 p2] } {
            set protocol [string tolower [expr {$p1 ne "" ? $p1 : $p2}]]
            if { $protocol ni $allowed_protocols } {
                return [subst {The allowed URLs can only use these protocols:
                    [join $allowed_protocols ", "].
                    You have a '$protocol' protocol in attribute '$attr_name' there.}]
            }
        }
        return ""

XQL Not present:

Generic, PostgreSQL, Oracle