@ez1219/sanitize-url 7.1.2-rc.0 → 7.1.2

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@ez1219/sanitize-url",
-  "version": "7.1.2-rc.0",
+  "version": "7.1.2",
   "description": "A url sanitizer",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
   "author": "",
   "scripts": {
     "prepublishOnly": "npm run build",

package/.cz-config.js

@@ -1,72 +0,0 @@
-module.exports = {
-  types: [
-    { value: "feat", name: "feat:     A new feature" },
-    { value: "fix", name: "fix:      A bug fix" },
-    {
-      value: "review",
-      name: "review:   Commits added during the review process",
-    },
-    { value: "docs", name: "docs:     Documentation only changes" },
-    {
-      value: "style",
-      name: "style:    Changes that do not affect the meaning of the code (formatting, semicolons)",
-    },
-    {
-      value: "refactor",
-      name: "refactor: A code change that neither fixes a bug nor adds a feature",
-    },
-    {
-      value: "perf",
-      name: "perf:     A code change that improves performance",
-    },
-    {
-      value: "test",
-      name: "test:     Adding missing tests or correcting existing tests",
-    },
-    { value: "build", name: "build:    Build system changes" },
-    {
-      value: "dx",
-      name: "dx:       Changes that affect the development cycle",
-    },
-    { value: "ci", name: "ci:       CI configuration changes" },
-    {
-      value: "chore",
-      name: "chore:    Other maintenance, including dependency updates",
-    },
-    { value: "revert", name: "revert:   Revert a commit" },
-  ],
-
-  scopes: [
-    { name: "american-express" },
-    { name: "apple-pay" },
-    { name: "client" },
-    { name: "data-collector" },
-    { name: "fastlane" },
-    { name: "google-payment" },
-    { name: "hosted-fields" },
-    { name: "instant-verification" },
-    { name: "local-payment" },
-    { name: "payment-ready" },
-    { name: "payment-request" },
-    { name: "paypal-checkout" },
-    { name: "paypal-checkout-v6" },
-    { name: "sepa" },
-    { name: "three-d-secure" },
-    { name: "us-bank-account" },
-    { name: "vault-manager" },
-    { name: "venmo" },
-    { name: "deps" },
-    { name: "other" },
-  ],
-
-  // When type is "review", skip the scope prompt entirely
-  scopeOverrides: {
-    review: [],
-  },
-
-  // Skip questions you don't need
-  skipQuestions: ["footer"],
-
-  // Limit subject length
-  subjectLimit: 85,
-};

package/.eslintignore

@@ -1,2 +0,0 @@
-dist
-coverage

package/.eslintrc

@@ -1,6 +0,0 @@
-{
-  "extends": "braintree/client",
-  "rules": {
-    "no-control-regex": 0
-  }
-}

package/.github/CODEOWNERS

@@ -1 +0,0 @@
-* @ez1219

package/.github/ISSUE_TEMPLATE/bug_report_form.yml

@@ -1,47 +0,0 @@
-name: Bug Report
-description: File a bug report.
-title: "[Bug]: "
-labels: ["bug", "triage"]
-projects: []
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this bug report!
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened?
-      description: Detail the bad behavior and the steps required to duplicate it
-      placeholder: Tell us what you see!
-      value: "A bug happened!"
-    validations:
-      required: true
-  - type: textarea
-    id: expected-behavior
-    attributes:
-      label: What did you expect to happen?
-      description: What did you expect to happen when performing the action?
-      placeholder: Expected behavior
-      value: "Expected behavior"
-    validations:
-      required: true
-  - type: input
-    id: version
-    attributes:
-      label: Version
-      description: What version of this library are you running?
-      placeholder: "v0.0.0"
-      value:
-    validations:
-      required: true
-  - type: textarea
-    id: browsers
-    attributes:
-      label: What browsers are you seeing the problem on?
-      description: |
-        List browsers where you see the problem reported. For example:
-          * Mac OS 15.3.5, Chrome 130.0.1234.987
-          * Android 14, Firefox 133.0
-          * iPadOS 17.1, Safari
-      placeholder: "For each browser specify 1) operating system and version 2) browser name and version"

package/.github/ISSUE_TEMPLATE/config.yml

@@ -1 +0,0 @@
-blank_issues_enabled: true

package/.github/ISSUE_TEMPLATE/feature_request_form.yml

@@ -1,30 +0,0 @@
-name: Feature Request
-description: Request a new feature.
-title: "[FR]: "
-labels: ["feature", "request", "enhancement", "triage"]
-projects: []
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for taking the time to fill out this feature request!
-  - type: textarea
-    id: feat-summary
-    attributes:
-      label: Feature Summary
-      description: In a few sentences or less, provide a concise description of the feature being requested.
-      placeholder: "New feature that does ___; it can be used when ..."
-    validations:
-      required: true
-  - type: textarea
-    id: detailed-description
-    attributes:
-      label: Detailed description of new feature.
-      description: |
-        Please provide a detailed description of proposed feature.
-          - What problem would this new feature solve?
-          - How will this change affect users?
-          - Is it a modification to existing functionality? Are you requesting a new/modified function input or output? Please provide an example of what the change might look like?
-      placeholder: "New feature details."
-    validations:
-      required: true

package/.github/dependabot.yml

@@ -1,16 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    open-pull-requests-limit: 3
-    allow:
-      - dependency-type: "development"
-        update-types:
-          - "version-update:semver-minor"
-    groups:
-      security-updates:
-        applies-to: security-updates
-        patterns:
-          - "*"

package/.github/pull_request_template.md

@@ -1,17 +0,0 @@
-# Summary of changes
-
--
-
-## Checklist
-
-- [ ] Added a changelog entry
-- [ ] Relevant test coverage
-- [ ] Tested and confirmed flows affected by this change are functioning as expected
-
-## Authors
-
-> List GitHub usernames for everyone who contributed to this pull request.
-
-### Reviewers
-
-@ez1219

package/.github/workflows/ci.yml

@@ -1,30 +0,0 @@
-name: "CI"
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-  pull_request:
-    branches:
-      - "*"
-
-permissions:
-  contents: read
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        node-version: [18, 20, 22, 24]
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ matrix.node-version }}
-          cache: "npm"
-      - run: npm ci
-      - run: npm test
-      - run: npm run build
-      - run: npm run lint

package/.github/workflows/enforce-conventional-pr-title.yml

@@ -1,39 +0,0 @@
-name: "PR Title Check"
-
-on:
-  pull_request:
-    types:
-      - opened
-      - edited
-      - reopened
-      - synchronize
-      - labeled
-      - ready_for_review
-
-jobs:
-  pr-title-check:
-    name: "Validate PR title"
-    if: >-
-      github.actor != 'dependabot[bot]' &&
-      !contains(github.actor, '[bot]') &&
-      github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50
-        with:
-          types: |
-            feat
-            fix
-            docs
-            style
-            refactor
-            perf
-            test
-            build
-            ci
-            chore
-            revert
-          requireScope: false
-          ignoreLabels: ignore-semantic-pull-request

package/.github/workflows/publish.yml

@@ -1,65 +0,0 @@
-name: "Publish to npm"
-run-name: Deploy ${{ github.repository }} to npmjs by @${{ github.actor }}
-
-on:
-  release:
-    types: [published]
-  workflow_dispatch:
-    inputs:
-      version_type:
-        description: "Version bump type (major, minor, patch)"
-        required: false
-        type: choice
-        default: "none"
-        options:
-          - none
-          - patch
-          - minor
-          - major
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: "npm"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Run tests
-        run: npm test
-
-      - name: Bump version & create GitHub Release
-        if: ${{ github.event_name == 'workflow_dispatch' && inputs.version_type != 'none' }}
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          npm version ${{ inputs.version_type }} -m "chore(release): %s [skip ci]"
-          git push
-          git push --tags
-          NEW_VERSION=$(node -p "require('./package.json').version")
-          gh release create "v$NEW_VERSION" --title "v$NEW_VERSION" --generate-notes
-
-      - name: Build package
-        run: npm run build
-
-      - name: Publish to npm (with Provenance / OIDC)
-        run: |
-          if [ -n "$NODE_AUTH_TOKEN" ]; then
-            npm config set //registry.npmjs.org/:_authToken "$NODE_AUTH_TOKEN"
-          fi
-          npm publish --access public --provenance
-        env:
-          NODE_AUTH_TOKEN: ${{ coalesce(secrets.NPM_TOKEN, secrets.NODE_AUTH_TOKEN) }}

package/.github/workflows/security.yml

@@ -1,22 +0,0 @@
-name: Security
-
-permissions:
-  contents: read
-  security-events: write
-
-on:
-  pull_request:
-    branches: [main]
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-jobs:
-  codeql:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: github/codeql-action/init@v3
-        with:
-          languages: javascript-typescript
-      - uses: github/codeql-action/analyze@v3

package/.github/workflows/stale-cleanup.yml

@@ -1,22 +0,0 @@
-name: "Stale Cleanup"
-
-on:
-  schedule:
-    # Runs at midnight UTC every Wednesday
-    - cron: "0 0 * * 3"
-  workflow_dispatch:
-
-permissions:
-  issues: write
-  pull-requests: write
-
-jobs:
-  stale:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/stale@v9
-        with:
-          stale-issue-message: "This issue is stale because it has been open for 60 days with no activity."
-          stale-pr-message: "This PR is stale because it has been open for 60 days with no activity."
-          days-before-stale: 60
-          days-before-close: 7

package/.husky/commit-msg

@@ -1,2 +0,0 @@
-#!/usr/bin/env bash
-npx --no -- commitlint --edit "$1"

package/.nvmrc

@@ -1 +0,0 @@
-v24

package/.prettierignore

@@ -1,3 +0,0 @@
-*-lock.json
-dist
-coverage

package/CHANGELOG.md

@@ -1,155 +0,0 @@
-# CHANGELOG
-
-## UNRELEASED
-
-- feat(deps): Add [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) to the repo
-
-## 7.1.2
-
-- Update dependencies
-  - @types/jest to 30.0.0
-  - @vitest/coverage-v8 to 4.0.16
-  - chai to 6.2.2
-  - eslint-plugin-prettier to 5.5.4
-  - happy-dom to 20.0.11
-  - prettier to 3.7.4
-  - typescript to 5.9.3
-  - vitest to 4.0.16
-- Update Node to v24
-- Add @types/node 24.0.0
-
-## 7.1.1
-
-- DevDependency Changes
-  - happy-dom to 15.11.6
-
-- Update (sub-)dependencies
-  - cross-spawn to 7.0.6
-  - micromatch to 4.0.8
-  - vite to 4.5.5
-
-## 7.1.0
-
-- Updated to handle back-slashes
-
-## 7.0.4
-
-- Updates get-func-name to 2.0.2
-
-## 7.0.3
-
-- Dependencies
-  - Update braces to 3.0.3
-
-## 7.0.2
-
-- Improve sanitization of whitespace escapes
-
-## 7.0.1
-
-- Improve sanitization of HTML entities
-
-## 7.0.0
-
-- Move constant declarations from index file to `constants.ts` file
-- Update to node v18
-
-- Dev Dependency Updates
-  - Update to TypeScript 5
-  - Other minor dependency updates
-
-## 6.0.4
-
-- Add additional null byte sanitization prior to html decoding (#48)
-
-## 6.0.3
-
-- Add null check to beginning of `sanitizeUrl` function ([#54](https://github.com/braintree/sanitize-url/issues/54))
-
-## 6.0.2
-
-- Fix issue where urls in the form `https://example.com

/something` were not properly sanitized
-
-## 6.0.1
-
-- Fix issue where urls in the form `javascript:alert('xss');` were not properly sanitized
-- Fix issue where urls in the form `javasc	ript:alert('XSS');` were not properly sanitized
-
-## 6.0.0
-
-- BREAKING CHANGES
-  - Decode HTML characters automatically that would result in an XSS vulnerability when rendering links via a server rendered HTML file
-
-```js
-// decodes to javacript:alert('XSS')
-const vulnerableUrl =
-  "&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041";
-
-sanitizeUrl(vulnerableUrl); // 'about:blank'
-
-const okUrl = "https://example.com/" + vulnerableUrl;
-
-// since the javascript bit is in the path instead of the protocol
-// this is successfully sanitized
-sanitizeUrl(okUrl); // 'https://example.com/javascript:alert('XSS');
-```
-
-## 5.0.2
-
-- Fix issue where certain invisible white space characters were not being sanitized (#35)
-
-## 5.0.1
-
-- Fix issue where certain safe characters were being filtered out (#31 thanks @akirchmyer)
-
-## 5.0.0
-
-- BREAKING CHANGES
-  - Sanitize vbscript urls (thanks @vicnicius)
-
-## 4.1.1
-
-- Fixup path to type declaration (closes #25)
-
-## 4.1.0
-
-- Add typescript types
-
-## 4.0.1
-
-- Fix issue where urls with accented characters were incorrectly sanitized
-
-## 4.0.0
-
-- BREAKING CHANGES
-  - Protocol-less urls (ie: `www.example.com`) will be sanitised and passed on instead of sending out `about:blank` (Thanks @chawes13 #18)
-
-## 3.1.0
-
-- Trim whitespace from urls
-
-## 3.0.0
-
-- BREAKING CHANGES
-  - Replace blank strings with about:blank
-  - Replace null values with about:blank
-
-## 2.1.0
-
-- Allow relative urls to be sanitized
-
-## 2.0.2
-
-- Sanitize malicious URLs that begin with `\s`
-
-## 2.0.1
-
-- Sanitize malicious URLs that begin with %20
-
-## 2.0.0
-
-- sanitize data: urls
-
-## 1.0.0
-
-- sanitize javascript: urls

package/CONTRIBUTING.md

@@ -1,79 +0,0 @@
-# Contributing
-
-Thanks for considering contributing to this project. Ways you can help:
-
-- [Create a pull request](https://help.github.com/articles/creating-a-pull-request)
-- [Add an issue](https://github.com/ez1219/sanitize-url/issues)
-
-## Development
-
-Clone this repo, then install the project's dependencies:
-
-```
-npm install
-```
-
-## Branch and PR Lifecycle
-
-To keep the repository healthy, an automated workflow runs weekly:
-
-- **Branches**: flagged after 21 days of inactivity; deleted 7 days later if
-  still inactive. To keep a branch, add new commits or remove the bot's comment.
-- **Pull requests**: commented on after 14 days of inactivity; closed 7 days
-  later if still inactive. Closed PRs can be reopened at any time.
-- **Issues**: commented on after 14 days of inactivity; closed 7 days later if
-  still inactive.
-
-You can open a fresh PR or issue at any time if automated cleanup closes yours.
-
-## Tests
-
-```
-npm test
-```
-
-### Test Stability, Quarantine & Remediation Policy
-
-Flaky tests are any test that passes and fails intermittently without code changes (this could be due to things like timeouts, inconsistent return values, poor assertions, etc). Flaky tests erode confidence in the test suite and slow down development. This section defines how we detect, quarantine, and remediate them.
-
-#### Detection
-
-- **Automatic retries**: Jest unit tests can be configured to automatically retry on failure via `jest.retryTimes()`. Playwright integration tests (where applicable) have retries configured per-project. A test that fails once but passes on retry can be considered as potentially flaky.
-- **Repeat failures**: If a test fails intermittently across multiple CI runs or PRs, it should be reported by opening a GitHub issue with the `flaky-test` label. Include the test name, file path, failure frequency, and any relevant error output.
-
-#### Quarantine
-
-When a test is confirmed flaky:
-
-1. **Open a tracking issue** in GitHub Issues. Use the `flaky-test` label and include:
-   - Test file path and test name
-   - Observed failure rate and pattern (e.g., "fails ~10% of runs", "only in CI")
-   - Stack trace or error message
-2. **Skip the test** using `.skip` and add a comment referencing the tracking issue:
-
-   ```javascript
-   // Quarantined: flaky due to timing sensitivity (https://github.com/braintree/sanitize-url/issues/123)
-   it.skip("should handle the edge case", function () {
-     // ...
-   });
-   ```
-
-   For `describe` blocks with multiple flaky tests, you may quarantine the entire block:
-
-   ```javascript
-   // Quarantined: intermittent failures under load (https://github.com/braintree/sanitize-url/issues/123)
-   describe.skip("feature under investigation", function () {
-     // ...
-   });
-   ```
-
-3. **Skipped tests are excluded from coverage reporting.** Since quarantined tests do not execute, their associated source code is not counted toward coverage metrics. This is expected and acceptable while the test is in quarantine.
-
-#### Remediation SLA
-
-Quarantined tests must be remedied within **30 days** of being quarantined. Remediation means one of the following:
-
-- **Fixed**: The root cause is identified and corrected, the `.skip` is removed, and the test passes reliably.
-- **Deleted**: If the test is no longer valuable or the feature it covers has changed, delete the test and close the tracking issue.
-
-If a quarantined test exceeds **14 days** without progress, it should be escalated and prioritized. Tests that remain skipped indefinitely are not acceptable.

package/SECURITY.md

@@ -1,41 +0,0 @@
-# Security Policy
-
-This repository adheres to the [PayPal Vulnerability Reporting Policy](https://hackerone.com/paypal).
-
-## Reporting a Vulnerability
-
-If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure.
-
-**Please do not report security vulnerabilities through public issues, discussions, or pull requests.**
-
-Instead, report it using one of the following ways:
-
-- Email the PayPal Security Team at [security@paypal.com](mailto:security@paypal.com)
-- Submit through the [PayPal Bug Bounty Program](https://hackerone.com/paypal) on HackerOne
-- Report a [vulnerability](https://github.com/ez1219/sanitize-url/security/advisories/new) directly via private vulnerability reporting on GitHub
-
-Please include the following in your report:
-
-- The type of issue and affected version(s)
-- Step-by-step instructions to reproduce the issue
-- Impact of the issue and how an attacker might exploit it
-
-## Supported Security Updates
-
-Only the latest release receives security patches and new versions in the case of a security issue.
-
-## Disclosure Policy
-
-We are committed to working with security researchers in good faith. To support responsible disclosure, our team will:
-
-- Acknowledge your report in a timely manner
-- Keep you informed of our progress toward a fix
-- Notify you before any public disclosure
-
-We ask that you:
-
-- Do not publicly disclose the issue before it has been resolved
-- Avoid accessing, modifying, or deleting data that does not belong to you
-- Make a good faith effort to avoid disruption to production systems
-
-We appreciate responsible disclosure and your efforts to keep Braintree SDK users safe.

package/commitlint.config.js

@@ -1,70 +0,0 @@
-// commitlint.config.js
-module.exports = {
-  extends: ["@commitlint/config-conventional"],
-
-  // Customize rules
-  rules: {
-    // Type must be one of the specified values
-    "type-enum": [
-      2, // Error level (0=off, 1=warn, 2=error)
-      "always",
-      [
-        "feat", // New feature
-        "fix", // Bug fix
-        "review",
-        "docs", // Documentation
-        "style", // Formatting
-        "refactor", // Code restructuring
-        "perf", // Performance
-        "test", // Tests
-        "build", // Build system
-        "dx", // Developer experience
-        "ci", // CI configuration
-        "chore", // Maintenance
-        "revert", // Revert commit
-      ],
-    ],
-
-    "scope-enum": [
-      2,
-      "always",
-      [
-        "american-express",
-        "apple-pay",
-        "client",
-        "data-collector",
-        "fastlane",
-        "google-payment",
-        "hosted-fields",
-        "instant-verification",
-        "local-payment",
-        "payment-ready",
-        "payment-request",
-        "paypal-checkout",
-        "paypal-checkout-v6",
-        "sepa",
-        "three-d-secure",
-        "us-bank-account",
-        "vault-manager",
-        "venmo",
-        "deps",
-        "dev-deps",
-        "other",
-      ],
-    ],
-    // Scope is optional but recommended
-    "scope-empty": [1, "never"],
-
-    // Subject configuration
-    "subject-empty": [2, "never"],
-    "subject-case": [0, "always", "sentence-case"],
-    "subject-full-stop": [1, "never", "."],
-    "subject-max-length": [2, "always", 85],
-
-    // Body configuration
-    "body-max-line-length": [2, "always", 100],
-
-    // Footer configuration
-    "footer-max-line-length": [2, "always", 100],
-  },
-};

package/src/__tests__/index.test.ts

@@ -1,299 +0,0 @@
-/* eslint-disable no-script-url */
-import { sanitizeUrl } from "..";
-import { BLANK_URL } from "../constants";
-
-describe("sanitizeUrl", () => {
-  it("does not alter http URLs with alphanumeric characters", () => {
-    expect(sanitizeUrl("http://example.com/path/to:something")).toBe(
-      "http://example.com/path/to:something",
-    );
-  });
-
-  it("does not alter http URLs with ports with alphanumeric characters", () => {
-    expect(sanitizeUrl("http://example.com:4567/path/to:something")).toBe(
-      "http://example.com:4567/path/to:something",
-    );
-  });
-
-  it("does not alter https URLs with alphanumeric characters", () => {
-    expect(sanitizeUrl("https://example.com")).toBe("https://example.com/");
-  });
-
-  it("does not alter https URLs with ports with alphanumeric characters", () => {
-    expect(sanitizeUrl("https://example.com:4567/path/to:something")).toBe(
-      "https://example.com:4567/path/to:something",
-    );
-  });
-
-  it("does not alter relative-path reference URLs with alphanumeric characters", () => {
-    expect(sanitizeUrl("./path/to/my.json")).toBe("./path/to/my.json");
-  });
-
-  it("does not alter absolute-path reference URLs with alphanumeric characters", () => {
-    expect(sanitizeUrl("/path/to/my.json")).toBe("/path/to/my.json");
-  });
-
-  it("does not alter protocol-less network-path URLs with alphanumeric characters", () => {
-    expect(sanitizeUrl("//google.com/robots.txt")).toBe(
-      "//google.com/robots.txt",
-    );
-  });
-
-  it("does not alter protocol-less URLs with alphanumeric characters", () => {
-    expect(sanitizeUrl("www.example.com")).toBe("www.example.com");
-  });
-
-  it("does not alter deep-link urls with alphanumeric characters", () => {
-    expect(sanitizeUrl("com.braintreepayments.demo://example")).toBe(
-      "com.braintreepayments.demo://example",
-    );
-  });
-
-  it("does not alter mailto urls with alphanumeric characters", () => {
-    expect(sanitizeUrl("mailto:test@example.com?subject=hello+world")).toBe(
-      "mailto:test@example.com?subject=hello+world",
-    );
-  });
-
-  it("does not alter urls with accented characters", () => {
-    expect(sanitizeUrl("www.example.com/with-áccêntš")).toBe(
-      "www.example.com/with-áccêntš",
-    );
-  });
-
-  it("does not strip harmless unicode characters", () => {
-    expect(sanitizeUrl("www.example.com/лот.рфшишкиü–")).toBe(
-      "www.example.com/лот.рфшишкиü–",
-    );
-  });
-
-  it("strips out ctrl chars", () => {
-    expect(
-      sanitizeUrl("www.example.com/\u200D\u0000\u001F\x00\x1F\uFEFFfoo"),
-    ).toBe("www.example.com/foo");
-  });
-
-  it(`replaces blank urls with ${BLANK_URL}`, () => {
-    expect(sanitizeUrl("")).toBe(BLANK_URL);
-  });
-
-  it(`replaces null values with ${BLANK_URL}`, () => {
-    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-    // @ts-ignore
-    expect(sanitizeUrl(null)).toBe(BLANK_URL);
-  });
-
-  it(`replaces undefined values with ${BLANK_URL}`, () => {
-    expect(sanitizeUrl()).toBe(BLANK_URL);
-  });
-
-  it("removes whitespace from urls", () => {
-    expect(sanitizeUrl("   http://example.com/path/to:something    ")).toBe(
-      "http://example.com/path/to:something",
-    );
-  });
-
-  it("removes newline entities from urls", () => {
-    expect(sanitizeUrl("https://example.com

/something")).toBe(
-      "https://example.com/something",
-    );
-  });
-
-  it("decodes html entities", () => {
-    // all these decode to javascript:alert('xss');
-    const attackVectors = [
-      "&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041",
-      "javascript:alert('XSS')",
-      "&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29",
-      "jav	ascript:alert('XSS');",
-      "  javascript:alert('XSS');",
-      "javasc	ript: alert('XSS');",
-      "javasc&#\u0000x09;ript:alert(1)",
-      "java&&#78&#59;ewLine&newline&#59;&#59;script:alert('XSS')",
-      "java&NewLine&newline;;script:alert('XSS')",
-    ];
-
-    attackVectors.forEach((vector) => {
-      expect(sanitizeUrl(vector)).toBe(BLANK_URL);
-    });
-
-    // https://example.com/javascript:alert('XSS')
-    // since the javascript is the url path, and not the protocol,
-    // this url is technically sanitized
-    expect(
-      sanitizeUrl(
-        "https&#0000058//example.com/&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041",
-      ),
-    ).toBe("https://example.com/javascript:alert('XSS')");
-  });
-
-  it("removes whitespace escape sequences", () => {
-    const attackVectors = [
-      "javascri\npt:alert('xss')",
-      "javascri\rpt:alert('xss')",
-      "javascri\tpt:alert('xss')",
-      "javascrip\\%74t:alert('XSS')",
-      "javascrip%5c%72t:alert()",
-      "javascrip%5Ctt:alert()",
-      "javascrip%255Ctt:alert()",
-      "javascrip%25%35Ctt:alert()",
-      "javascrip%25%35%43tt:alert()",
-      "javascrip%25%32%35%25%33%35%25%34%33rt:alert()",
-      "javascrip%255Crt:alert('%25xss')",
-    ];
-
-    attackVectors.forEach((vector) => {
-      expect(sanitizeUrl(vector)).toBe(BLANK_URL);
-    });
-  });
-
-  it("backslash prefixed attack vectors", () => {
-    const attackVectors = [
-      "\fjavascript:alert()",
-      "\vjavascript:alert()",
-      "\tjavascript:alert()",
-      "\njavascript:alert()",
-      "\rjavascript:alert()",
-      "\u0000javascript:alert()",
-      "\u0001javascript:alert()",
-    ];
-
-    attackVectors.forEach((vector) => {
-      expect(sanitizeUrl(vector)).toBe(BLANK_URL);
-    });
-  });
-
-  it("reverses backslashes", () => {
-    const attack = "\\j\\av\\a\\s\\cript:alert()";
-
-    expect(sanitizeUrl(attack)).toBe("/j/av/a/s/cript:alert()");
-  });
-
-  describe("invalid protocols", () => {
-    describe.each(["javascript", "data", "vbscript"])("%s", (protocol) => {
-      it(`replaces ${protocol} urls with ${BLANK_URL}`, () => {
-        expect(sanitizeUrl(`${protocol}:alert(document.domain)`)).toBe(
-          BLANK_URL,
-        );
-      });
-
-      it(`allows ${protocol} urls that start with a letter prefix`, () => {
-        expect(sanitizeUrl(`not_${protocol}:alert(document.domain)`)).toBe(
-          `not_${protocol}:alert(document.domain)`,
-        );
-      });
-
-      it(`disallows ${protocol} urls that start with non-\w characters as a suffix for the protocol`, () => {
-        expect(sanitizeUrl(`&!*${protocol}:alert(document.domain)`)).toBe(
-          BLANK_URL,
-        );
-      });
-
-      it(`disallows ${protocol} urls that use : for the colon portion of the url`, () => {
-        expect(sanitizeUrl(`${protocol}:alert(document.domain)`)).toBe(
-          BLANK_URL,
-        );
-        expect(sanitizeUrl(`${protocol}:alert(document.domain)`)).toBe(
-          BLANK_URL,
-        );
-      });
-
-      it(`disregards capitalization for ${protocol} urls`, () => {
-        // upper case every other letter in protocol name
-        const mixedCapitalizationProtocol = protocol
-          .split("")
-          .map((character, index) => {
-            if (index % 2 === 0) {
-              return character.toUpperCase();
-            }
-            return character;
-          })
-          .join("");
-
-        expect(
-          sanitizeUrl(`${mixedCapitalizationProtocol}:alert(document.domain)`),
-        ).toBe(BLANK_URL);
-      });
-
-      it(`ignores invisible ctrl characters in ${protocol} urls`, () => {
-        const protocolWithControlCharacters = protocol
-          .split("")
-          .map((character, index) => {
-            if (index === 1) {
-              return character + "%EF%BB%BF%EF%BB%BF";
-            } else if (index === 2) {
-              return character + "%e2%80%8b";
-            }
-            return character;
-          })
-          .join("");
-
-        expect(
-          sanitizeUrl(
-            decodeURIComponent(
-              `${protocolWithControlCharacters}:alert(document.domain)`,
-            ),
-          ),
-        ).toBe(BLANK_URL);
-      });
-
-      it(`replaces ${protocol} urls with ${BLANK_URL} when url begins with %20`, () => {
-        expect(
-          sanitizeUrl(
-            decodeURIComponent(
-              `%20%20%20%20${protocol}:alert(document.domain)`,
-            ),
-          ),
-        ).toBe(BLANK_URL);
-      });
-
-      it(`replaces ${protocol} urls with ${BLANK_URL} when ${protocol} url begins with spaces`, () => {
-        expect(sanitizeUrl(`    ${protocol}:alert(document.domain)`)).toBe(
-          BLANK_URL,
-        );
-      });
-
-      it(`does not replace ${protocol}: if it is not in the scheme of the URL`, () => {
-        expect(sanitizeUrl(`http://example.com#${protocol}:foo`)).toBe(
-          `http://example.com#${protocol}:foo`,
-        );
-      });
-    });
-  });
-
-  it("replaces invalid http/https URLs with BLANK_URL", () => {
-    expect(sanitizeUrl("http://[invalid]")).toBe(BLANK_URL);
-    expect(sanitizeUrl("https://[invalid]")).toBe(BLANK_URL);
-  });
-
-  describe("when URL.canParse is undefined", () => {
-    let originalCanParse: typeof URL.canParse;
-
-    beforeEach(() => {
-      originalCanParse = URL.canParse;
-      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
-      // @ts-ignore
-      URL.canParse = null;
-    });
-
-    afterEach(() => {
-      URL.canParse = originalCanParse;
-    });
-
-    it("sanitizes valid http/https URLs properly using fallback", () => {
-      expect(sanitizeUrl("http://example.com/path")).toBe(
-        "http://example.com/path",
-      );
-      expect(sanitizeUrl("https://example.com")).toBe("https://example.com/");
-    });
-
-    it("replaces invalid http/https URLs with BLANK_URL using fallback", () => {
-      expect(sanitizeUrl("http://[invalid]")).toBe(BLANK_URL);
-      expect(sanitizeUrl("https://[invalid]")).toBe(BLANK_URL);
-    });
-
-    it("replaces javascript URLs with BLANK_URL", () => {
-      expect(sanitizeUrl("javascript:alert(1)")).toBe(BLANK_URL);
-    });
-  });
-});

package/src/constants.ts

@@ -1,10 +0,0 @@
-export const invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im;
-export const htmlEntitiesRegex = /&#(\w+)(^\w|;)?/g;
-export const htmlCtrlEntityRegex = /&(newline|tab);/gi;
-export const ctrlCharactersRegex =
-  /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
-export const urlSchemeRegex = /^.+(:|:)/gim;
-export const whitespaceEscapeCharsRegex =
-  /(\\|%5[cC])((%(6[eE]|72|74))|[nrt])/g;
-export const relativeFirstCharacters = [".", "/"];
-export const BLANK_URL = "about:blank";

package/src/index.ts

@@ -1,114 +0,0 @@
-import {
-  BLANK_URL,
-  ctrlCharactersRegex,
-  htmlCtrlEntityRegex,
-  htmlEntitiesRegex,
-  invalidProtocolRegex,
-  relativeFirstCharacters,
-  whitespaceEscapeCharsRegex,
-  urlSchemeRegex,
-} from "./constants";
-
-function isRelativeUrlWithoutProtocol(url: string): boolean {
-  return relativeFirstCharacters.indexOf(url[0]) > -1;
-}
-
-function decodeHtmlCharacters(str: string) {
-  const removedNullByte = str.replace(ctrlCharactersRegex, "");
-  return removedNullByte.replace(htmlEntitiesRegex, (match, dec) => {
-    return String.fromCharCode(dec);
-  });
-}
-
-function isValidUrl(url: string): boolean {
-  if (typeof URL !== "undefined" && typeof URL.canParse === "function") {
-    return URL.canParse(url);
-  }
-  try {
-    return Boolean(new URL(url));
-  } catch {
-    return false;
-  }
-}
-
-function decodeURI(uri: string): string {
-  try {
-    return decodeURIComponent(uri);
-  } catch (e: unknown) {
-    // Ignoring error
-    // It is possible that the URI contains a `%` not associated
-    // with URI/URL-encoding.
-    return uri;
-  }
-}
-
-export function sanitizeUrl(url?: string): string {
-  if (!url) {
-    return BLANK_URL;
-  }
-
-  let charsToDecode;
-  let decodedUrl = decodeURI(url.trim());
-
-  do {
-    decodedUrl = decodeHtmlCharacters(decodedUrl)
-      .replace(htmlCtrlEntityRegex, "")
-      .replace(ctrlCharactersRegex, "")
-      .replace(whitespaceEscapeCharsRegex, "")
-      .trim();
-
-    decodedUrl = decodeURI(decodedUrl);
-
-    charsToDecode =
-      decodedUrl.match(ctrlCharactersRegex) ||
-      decodedUrl.match(htmlEntitiesRegex) ||
-      decodedUrl.match(htmlCtrlEntityRegex) ||
-      decodedUrl.match(whitespaceEscapeCharsRegex);
-  } while (charsToDecode && charsToDecode.length > 0);
-
-  const sanitizedUrl = decodedUrl;
-
-  if (!sanitizedUrl) {
-    return BLANK_URL;
-  }
-
-  if (isRelativeUrlWithoutProtocol(sanitizedUrl)) {
-    return sanitizedUrl;
-  }
-
-  // Remove any leading whitespace before checking the URL scheme
-  const trimmedUrl = sanitizedUrl.trimStart();
-  const urlSchemeParseResults = trimmedUrl.match(urlSchemeRegex);
-
-  if (!urlSchemeParseResults) {
-    return sanitizedUrl;
-  }
-
-  const urlScheme = urlSchemeParseResults[0].toLowerCase().trim();
-
-  if (invalidProtocolRegex.test(urlScheme)) {
-    return BLANK_URL;
-  }
-
-  const backSanitized = trimmedUrl.replace(/\\/g, "/");
-
-  // Handle special cases for mailto: and custom deep-link protocols
-  if (urlScheme === "mailto:" || urlScheme.includes("://")) {
-    return backSanitized;
-  }
-
-  // For http and https URLs, perform additional validation
-  if (urlScheme === "http:" || urlScheme === "https:") {
-    if (!isValidUrl(backSanitized)) {
-      return BLANK_URL;
-    }
-
-    const url = new URL(backSanitized);
-    url.protocol = url.protocol.toLowerCase();
-    url.hostname = url.hostname.toLowerCase();
-
-    return url.toString();
-  }
-
-  return backSanitized;
-}

package/tsconfig.json

@@ -1,12 +0,0 @@
-{
-  "compilerOptions": {
-    "outDir": "./dist",
-    "allowJs": true,
-    "strict": true,
-    "target": "es5",
-    "resolveJsonModule": true,
-    "lib": ["es2015", "dom"]
-  },
-  "include": ["./src/**/*"],
-  "exclude": ["**/__tests__/*"]
-}

package/vitest.config.ts

@@ -1,17 +0,0 @@
-import { defineConfig } from "vitest/config";
-
-export default defineConfig({
-  test: {
-    globals: true,
-    environment: "happy-dom",
-    coverage: {
-      enabled: true,
-      thresholds: {
-        lines: 80,
-        statements: 80,
-        branches: 80,
-        functions: 80,
-      },
-    },
-  },
-});