Can I make the protocol scheme for URL parsing configurable?

[upputter]

Moin people!

The core function isSafeUrl() uses a fixed list of possible protocols (http|https|ftp|mailto|tel).
So only valid protocols allow links to be created in Markdown. Otherwise a error-xss-filter will be the result.

It would be great if this list could be customised via system settings.

[upputter]

I tried to modify the yellow-core accordingly.

One of you may take a look at upputter/yellow@49bfb35
It adds a system setting coreSafeUrlProtocols, which then will be used in the isSafeUrl()-method.

With this little tweak, you can add further protocols to the url parsing of yellow, e.g.: irc://, threema://, geo://, ....

[upputter]

Another attempt would be to keep the yellow core untouched and use a little extension.

I fiddeled around a bit and came to a rather nice solution, I think:

<?php
// get the global yellow core
global $yellow;
// set default protocols
$yellow->system->setDefault("coreSafeUrlProtocols", "http,https,ftp,mailto,tel");
// override yellow lookup
$yellow->lookup = new YellowLookupExtended($yellow);

class YellowLookupExtended extends YellowLookup
{
    public function isSafeUrl($url)
    {
        $protocols = implode('|', preg_split("/\s*,\s*/", $this->yellow->system->get("coreSafeUrlProtocols")));
        return preg_match("/^(" . $protocols . "):/", $url);
    }
}

It's like a normal yellow extension, but without any standard methods. While being loaded in the process of the normal extension loading, it will:

• get the global $yellow variable from /yellow.php
• set a configuration parameter coreSafeUrlProtocols
• override the core lookup class with an extension of YellowLookup

The - now modified - yellow core uses the extended YellowLookup class to validate an $url.

Works like charm!