diff --git a/library/HTMLPurifier/URI.php b/library/HTMLPurifier/URI.php
index a5e7ae29..13b16d89 100644
--- a/library/HTMLPurifier/URI.php
+++ b/library/HTMLPurifier/URI.php
@@ -124,8 +124,10 @@ class HTMLPurifier_URI
// scheme is in our registry, since a URIFilter may convert a
// URI that we don't allow into one we do. So instead, we just
// check if the scheme can be dropped because there is no host
- // and it is our default scheme.
- if (!is_null($this->scheme) && is_null($this->host) || $this->host === '') {
+ // or the host can be omitted and it is our default scheme.
+ if (!is_null($this->scheme) &&
+ (!$this->getSchemeObj($config, $context)->may_omit_host && (is_null($this->host) || $this->host === ''))
+ ) {
// support for relative paths is pretty abysmal when the
// scheme is present, so axe it when possible
$def = $config->getDefinition('URI');
diff --git a/tests/HTMLPurifier/URITest.php b/tests/HTMLPurifier/URITest.php
index 91509d69..5d97f680 100644
--- a/tests/HTMLPurifier/URITest.php
+++ b/tests/HTMLPurifier/URITest.php
@@ -225,6 +225,22 @@ class HTMLPurifier_URITest extends HTMLPurifier_URIHarness
$this->assertValidation('http://google.com');
}
+ public function test_validate_schemeIsDefaultAndTheOnlyAllowed()
+ {
+ $uri =
+ 'data:'.
+ 'image/png,'.
+ 'iVBORw0KGgoAAAANSUhEUgAAAAoAAAAKCAYAAACNMs+9AAAABGdBTUEAALGP'.
+ 'C/xhBQAAAAlwSFlzAAALEwAACxMBAJqcGAAAAAd0SU1FB9YGARc5KB0XV+IA'.
+ 'AAAddEVYdENvbW1lbnQAQ3JlYXRlZCB3aXRoIFRoZSBHSU1Q72QlbgAAAF1J'.
+ 'REFUGNO9zL0NglAAxPEfdLTs4BZM4DIO4C7OwQg2JoQ9LE1exdlYvBBeZ7jq'.
+ 'ch9//q1uH4TLzw4d6+ErXMMcXuHWxId3KOETnnXXV6MJpcq2MLaI97CER3N0'.
+ 'vr4MkhoXe0rZigAAAABJRU5ErkJggg==';
+
+ $this->config->set('URI.DefaultScheme', 'data');
+ $this->config->set('URI.AllowedSchemes', array('data' => true));
+ $this->assertValidation($uri, $uri);
+ }
}
// vim: et sw=4 sts=4