1 parent 5ce31ba commit 6b4eae6Copy full SHA for 6b4eae6
1 file changed
src/lib/performance/core-web-vitals.ts
@@ -71,7 +71,7 @@ export class LazyImageLoader {
71
// Only allow http(s) absolute URLs and root-relative paths.
72
// Explicitly reject protocol-relative (//) and javascript:/data:
73
// to prevent scheme injection via data-src attributes.
74
- if (/^https?:\/\//i.test(dataSrc) || /^\/[^\/]/.test(dataSrc)) {
+ if (/^https?:\/\//i.test(dataSrc) || /^\/[^/]/.test(dataSrc)) {
75
img.src = dataSrc;
76
img.removeAttribute('data-src');
77
}
0 commit comments