luciano/d2
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

don't consider tooltip value a valid url if host is empty

Browse source
This commit is contained in:
Gavin Nishizawa 2023-06-09 14:07:24 -07:00
parent 405f1c9777
commit 28be902870
No known key found for this signature in database
GPG key ID: AE3B177777CE55CD
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
d2compiler/compile.go
View file

@ -533,8 +533,8 @@ func (c *compiler) compileReserved(attrs *d2graph.Attributes, f *d2ir.Field) {
}
if attrs.Link != nil && attrs.Tooltip != nil {
_, err := url.ParseRequestURI(attrs.Tooltip.Value)
if err == nil {
u, err := url.ParseRequestURI(attrs.Tooltip.Value)
if err == nil && u.Host != "" {
c.errorf(scalar, "Tooltip cannot be set to URL when link is also set (for security)")
}
}