Important security fix

1 files changed, 14 insertions, 3 deletions

diff --git a/pluginManager.js b/pluginManager.js
index 8e520ec..f28590a 100644
--- a/pluginManager.js
+++ b/pluginManager.js
@@ -4,7 +4,7 @@ var PLUGIN_INFO =
 <description>Manage Vimperator Plugins</description>
 <description lang="ja">Vimpeatorプラグインの管理</description>
 <author mail="teramako@gmail.com" homepage="http://d.hatena.ne.jp/teramako/">teramako</author>
-<version>0.6.6</version>
+<version>0.6.7</version>
 <minVersion>2.3</minVersion>
 <maxVersion>2.4</maxVersion>
 <updateURL>https://github.com/vimpr/vimperator-plugins/raw/master/pluginManager.js</updateURL>
@@ -190,8 +190,19 @@ for (let it in Iterator(tags)){
     };
 }
 function makeLink(str, withLink){
-    var href = withLink ? '$&' : '#';
-    return XMLList(str.replace(/(?:https?:\/\/|mailto:)\S+/g, '<a href="' + href + '" highlight="URL">$&</a>'));
+    let s = str;
+    let result = XMLList();
+    while (s.length > 0) {
+        let m = s.match(/(?:https?:\/\/|mailto:)\S+/);
+        if (m) {
+            result += <>{s.slice(0, m.index)}<a href={withLink ? m[0] : '#'} highlight="URL">{m[0]}</a></>;
+            s = s.slice(m.index + m[0].length);
+        } else {
+            result += <>{s}</>;
+            break;
+        }
+    }
+    return result;
 }
 function fromUTF8Octets(octets){
     return decodeURIComponent(octets.replace(/[%\x80-\xFF]/g, function(c){