diff --git a/src/com/google/caja/plugin/html-sanitizer.js b/src/com/google/caja/plugin/html-sanitizer.js
index d803c3e9..e249d52c 100644
--- a/src/com/google/caja/plugin/html-sanitizer.js
+++ b/src/com/google/caja/plugin/html-sanitizer.js
@@ -812,13 +812,17 @@ var html = (function(html4) {
var ALLOWED_URI_SCHEMES = /^(?:https?|geo|mailto|sms|tel)$/i;
+ function getAllowedUriSchemes() {
+ return html4.allowedUriSchemes || ALLOWED_URI_SCHEMES;
+ }
+
function safeUri(uri, effect, ltype, hints, naiveUriRewriter) {
if (!naiveUriRewriter) { return null; }
try {
var parsed = URI.parse('' + uri);
if (parsed) {
if (!parsed.hasScheme() ||
- ALLOWED_URI_SCHEMES.test(parsed.getScheme())) {
+ getAllowedUriSchemes().test(parsed.getScheme())) {
var safe = naiveUriRewriter(parsed, effect, ltype, hints);
return safe ? safe.toString() : null;
}
diff --git a/src/com/google/caja/plugin/sanitizecss.js b/src/com/google/caja/plugin/sanitizecss.js
index 72901d5a..d6f40988 100644
--- a/src/com/google/caja/plugin/sanitizecss.js
+++ b/src/com/google/caja/plugin/sanitizecss.js
@@ -92,6 +92,10 @@ var sanitizeMediaQuery = undefined;
var ALLOWED_URI_SCHEMES = /^(?:https?|geo|mailto|sms|tel)$/i;
+ function getAllowedUriSchemes() {
+ return html4.allowedUriSchemes || ALLOWED_URI_SCHEMES;
+ }
+
function resolveUri(baseUri, uri) {
if (baseUri) {
return URI.utils.resolve(baseUri, uri);
@@ -102,7 +106,7 @@ var sanitizeMediaQuery = undefined;
function safeUri(uri, prop, naiveUriRewriter) {
if (!naiveUriRewriter) { return null; }
var parsed = ('' + uri).match(URI_SCHEME_RE);
- if (parsed && (!parsed[1] || ALLOWED_URI_SCHEMES.test(parsed[1]))) {
+ if (parsed && (!parsed[1] || getAllowedUriSchemes().test(parsed[1]))) {
return naiveUriRewriter(uri, prop);
} else {
return null;