Correctly validate the mime-type part of data-uris. Fixes #1607.

hapijs · Nov 11, 2018 · 1c9d2bb · 1c9d2bb
1 parent a483e18
commit 1c9d2bb
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/lib/types/string/index.js b/lib/types/string/index.js
@@ -471,7 +471,7 @@ internals.String = class extends Any {
 
     dataUri(dataUriOptions = {}) {
 
-        const regex = /^data:[\w\/\+]+;((charset=[\w-]+|base64),)?(.*)$/;
+        const regex = /^data:[\w+.-]+\/[\w+.-]+;((charset=[\w-]+|base64),)?(.*)$/;
 
         // Determine if padding is required.
         const paddingRequired = dataUriOptions.paddingRequired === false ?

diff --git a/test/types/string.js b/test/types/string.js
@@ -10222,7 +10222,8 @@ describe('string', () => {
                     }]
                 }],
                 ['data:image/png;base64,YW55IGNhcm5hbCBwbGVhc3VyZS4=', true],
-                ['data:image/png;charset=utf-8,=YW55IGNhcm5hbCBwbGVhc3VyZS', true]
+                ['data:image/png;charset=utf-8,=YW55IGNhcm5hbCBwbGVhc3VyZS', true],
+                ['data:text/x-script.phyton;charset=utf-8,=YW55IGNhcm5hbCBwbGVhc3VyZS', true]
             ]);
         });