ElbowPatch.apply 'CVE-2013-0157', '3.2.0' => '3.2.12', '3.1.0' => '3.1.11', '2.3.0' => '2.3.7' do

  module HTML
    class WhiteListSanitizer
      # CVE-2013-1857
      self.protocol_separator = /:|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i

      def contains_bad_protocols?(attr_name, value)
        uri_attributes.include?(attr_name) &&
            (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(&#x0*3a)|(%|&#37;)3A/i && !allowed_protocols.include?(value.split(protocol_separator).first.downcase.strip))
      end

    end
  end
end
