|
|
@ -54,7 +54,7 @@ var protocolPattern = /^([a-z0-9.+-]+:)/i, |
|
|
|
delims = ['<', '>', '"', '`', ' ', '\r', '\n', '\t'], |
|
|
|
|
|
|
|
// RFC 2396: characters not allowed for various reasons.
|
|
|
|
unwise = ['{', '}', '|', '\\', '^', '~', '`'].concat(delims), |
|
|
|
unwise = ['{', '}', '|', '\\', '^', '`'].concat(delims), |
|
|
|
|
|
|
|
// Allowed by RFCs, but cause of XSS attacks. Always escape these.
|
|
|
|
autoEscape = ['\''].concat(unwise), |
|
|
|