Fix zero-padded colon entities passing _safe_href check

CHANGES.md

@@ -14,6 +14,7 @@
 - [pull #705] XSS fixes in links, images, and more
 - [pull #720] Add `wiki-links` extra for `[[Page Name]]` style links (#221)
 - [pull #722] Harden URL safety checks and sanitization in safe mode (#721)
+- [pull #728] Fix XSS from zero-padded colon entities in link URLs (#726)
 
 
 ## python-markdown2 2.5.5

lib/markdown2.py

@@ -1618,7 +1618,8 @@ def _safe_href(self):
         less_safe = r'#/\.!#$%&\(\)\+,/:;=\?@\[\]^`\{\}\|~'
         # html encoded colon in a URL still functions as a normal colon, so need to detect those
         # semicolon at the end is optional in browsers - see #721
-        protocol_seperators = [':', r':?', r':?', r':?']
+        # numeric references can be zero-padded (&#058, &#x003a) - see #726
+        protocol_seperators = [':', r'&#x0*3a;?', r'&#0*58;?', r':?']
         # dot seperated hostname, optional port number, not followed by protocol seperator
         domain = r'(?:[{}]+(?:\.[{}]+)*)(?:(?<!tel)(?<!javascript):\d+/?)?(?![^:/]*(?:{})/*)'.format(safe, safe, '|'.join(protocol_seperators))
         fragment = r'[%s]*' % (safe + less_safe)

test/tm-cases/xss_issue726.html

@@ -0,0 +1,7 @@
+<p><a href="#">Click me</a></p>
+
+<p><a href="#">Click me</a></p>
+
+<p><a href="#">Click me</a></p>
+
+<p><a href="#">Click me</a></p>

test/tm-cases/xss_issue726.opts

@@ -0,0 +1 @@
+{"safe_mode": "escape"}

test/tm-cases/xss_issue726.text

@@ -0,0 +1,7 @@
+[Click me](javascript&#058alert(origin))
+
+[Click me](javascript:alert(origin))
+
+[Click me](javascript:alert(origin))
+
+[Click me](javascript:alert(origin))