XSS is Possible in URL function

[soaj1664]

Hi,

XSS is possible in URL function that is available here:

feindura-flat-file-cms/library/classes/XssFilter.class.php

Line 410 in 527920f

public static function url($data, $encode = false, $default = false){

The vector is:
javascript://www.xss.com?%0aalert%281%29

The regular expression you are using happily parse the above vector and attacker can execute JavaScript. The easiest fix would be instead of having a-z and A-Z in regular expression ... It should be something like http or https ...