@ez1219/sanitize-url 7.1.2-rc.0

package/.cz-config.js

@@ -0,0 +1,72 @@
+module.exports = {
+  types: [
+    { value: "feat", name: "feat:     A new feature" },
+    { value: "fix", name: "fix:      A bug fix" },
+    {
+      value: "review",
+      name: "review:   Commits added during the review process",
+    },
+    { value: "docs", name: "docs:     Documentation only changes" },
+    {
+      value: "style",
+      name: "style:    Changes that do not affect the meaning of the code (formatting, semicolons)",
+    },
+    {
+      value: "refactor",
+      name: "refactor: A code change that neither fixes a bug nor adds a feature",
+    },
+    {
+      value: "perf",
+      name: "perf:     A code change that improves performance",
+    },
+    {
+      value: "test",
+      name: "test:     Adding missing tests or correcting existing tests",
+    },
+    { value: "build", name: "build:    Build system changes" },
+    {
+      value: "dx",
+      name: "dx:       Changes that affect the development cycle",
+    },
+    { value: "ci", name: "ci:       CI configuration changes" },
+    {
+      value: "chore",
+      name: "chore:    Other maintenance, including dependency updates",
+    },
+    { value: "revert", name: "revert:   Revert a commit" },
+  ],
+
+  scopes: [
+    { name: "american-express" },
+    { name: "apple-pay" },
+    { name: "client" },
+    { name: "data-collector" },
+    { name: "fastlane" },
+    { name: "google-payment" },
+    { name: "hosted-fields" },
+    { name: "instant-verification" },
+    { name: "local-payment" },
+    { name: "payment-ready" },
+    { name: "payment-request" },
+    { name: "paypal-checkout" },
+    { name: "paypal-checkout-v6" },
+    { name: "sepa" },
+    { name: "three-d-secure" },
+    { name: "us-bank-account" },
+    { name: "vault-manager" },
+    { name: "venmo" },
+    { name: "deps" },
+    { name: "other" },
+  ],
+
+  // When type is "review", skip the scope prompt entirely
+  scopeOverrides: {
+    review: [],
+  },
+
+  // Skip questions you don't need
+  skipQuestions: ["footer"],
+
+  // Limit subject length
+  subjectLimit: 85,
+};

package/.eslintignore

@@ -0,0 +1,2 @@
+dist
+coverage

package/.eslintrc

@@ -0,0 +1,6 @@
+{
+  "extends": "braintree/client",
+  "rules": {
+    "no-control-regex": 0
+  }
+}

package/.github/CODEOWNERS

@@ -0,0 +1 @@
+* @ez1219

package/.github/ISSUE_TEMPLATE/bug_report_form.yml

@@ -0,0 +1,47 @@
+name: Bug Report
+description: File a bug report.
+title: "[Bug]: "
+labels: ["bug", "triage"]
+projects: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this bug report!
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: Detail the bad behavior and the steps required to duplicate it
+      placeholder: Tell us what you see!
+      value: "A bug happened!"
+    validations:
+      required: true
+  - type: textarea
+    id: expected-behavior
+    attributes:
+      label: What did you expect to happen?
+      description: What did you expect to happen when performing the action?
+      placeholder: Expected behavior
+      value: "Expected behavior"
+    validations:
+      required: true
+  - type: input
+    id: version
+    attributes:
+      label: Version
+      description: What version of this library are you running?
+      placeholder: "v0.0.0"
+      value:
+    validations:
+      required: true
+  - type: textarea
+    id: browsers
+    attributes:
+      label: What browsers are you seeing the problem on?
+      description: |
+        List browsers where you see the problem reported. For example:
+          * Mac OS 15.3.5, Chrome 130.0.1234.987
+          * Android 14, Firefox 133.0
+          * iPadOS 17.1, Safari
+      placeholder: "For each browser specify 1) operating system and version 2) browser name and version"

package/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: true

package/.github/ISSUE_TEMPLATE/feature_request_form.yml

@@ -0,0 +1,30 @@
+name: Feature Request
+description: Request a new feature.
+title: "[FR]: "
+labels: ["feature", "request", "enhancement", "triage"]
+projects: []
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for taking the time to fill out this feature request!
+  - type: textarea
+    id: feat-summary
+    attributes:
+      label: Feature Summary
+      description: In a few sentences or less, provide a concise description of the feature being requested.
+      placeholder: "New feature that does ___; it can be used when ..."
+    validations:
+      required: true
+  - type: textarea
+    id: detailed-description
+    attributes:
+      label: Detailed description of new feature.
+      description: |
+        Please provide a detailed description of proposed feature.
+          - What problem would this new feature solve?
+          - How will this change affect users?
+          - Is it a modification to existing functionality? Are you requesting a new/modified function input or output? Please provide an example of what the change might look like?
+      placeholder: "New feature details."
+    validations:
+      required: true

package/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    allow:
+      - dependency-type: "development"
+        update-types:
+          - "version-update:semver-minor"
+    groups:
+      security-updates:
+        applies-to: security-updates
+        patterns:
+          - "*"

package/.github/pull_request_template.md

@@ -0,0 +1,17 @@
+# Summary of changes
+
+-
+
+## Checklist
+
+- [ ] Added a changelog entry
+- [ ] Relevant test coverage
+- [ ] Tested and confirmed flows affected by this change are functioning as expected
+
+## Authors
+
+> List GitHub usernames for everyone who contributed to this pull request.
+
+### Reviewers
+
+@ez1219

package/.github/workflows/ci.yml

@@ -0,0 +1,30 @@
+name: "CI"
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - "*"
+
+permissions:
+  contents: read
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: [18, 20, 22, 24]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: "npm"
+      - run: npm ci
+      - run: npm test
+      - run: npm run build
+      - run: npm run lint

package/.github/workflows/enforce-conventional-pr-title.yml

@@ -0,0 +1,39 @@
+name: "PR Title Check"
+
+on:
+  pull_request:
+    types:
+      - opened
+      - edited
+      - reopened
+      - synchronize
+      - labeled
+      - ready_for_review
+
+jobs:
+  pr-title-check:
+    name: "Validate PR title"
+    if: >-
+      github.actor != 'dependabot[bot]' &&
+      !contains(github.actor, '[bot]') &&
+      github.event.pull_request.draft == false
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+          requireScope: false
+          ignoreLabels: ignore-semantic-pull-request

package/.github/workflows/publish.yml

@@ -0,0 +1,65 @@
+name: "Publish to npm"
+run-name: Deploy ${{ github.repository }} to npmjs by @${{ github.actor }}
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+    inputs:
+      version_type:
+        description: "Version bump type (major, minor, patch)"
+        required: false
+        type: choice
+        default: "none"
+        options:
+          - none
+          - patch
+          - minor
+          - major
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: "npm"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run tests
+        run: npm test
+
+      - name: Bump version & create GitHub Release
+        if: ${{ github.event_name == 'workflow_dispatch' && inputs.version_type != 'none' }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          npm version ${{ inputs.version_type }} -m "chore(release): %s [skip ci]"
+          git push
+          git push --tags
+          NEW_VERSION=$(node -p "require('./package.json').version")
+          gh release create "v$NEW_VERSION" --title "v$NEW_VERSION" --generate-notes
+
+      - name: Build package
+        run: npm run build
+
+      - name: Publish to npm (with Provenance / OIDC)
+        run: |
+          if [ -n "$NODE_AUTH_TOKEN" ]; then
+            npm config set //registry.npmjs.org/:_authToken "$NODE_AUTH_TOKEN"
+          fi
+          npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ coalesce(secrets.NPM_TOKEN, secrets.NODE_AUTH_TOKEN) }}

package/.github/workflows/security.yml

@@ -0,0 +1,22 @@
+name: Security
+
+permissions:
+  contents: read
+  security-events: write
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  codeql:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: javascript-typescript
+      - uses: github/codeql-action/analyze@v3

package/.github/workflows/stale-cleanup.yml

@@ -0,0 +1,22 @@
+name: "Stale Cleanup"
+
+on:
+  schedule:
+    # Runs at midnight UTC every Wednesday
+    - cron: "0 0 * * 3"
+  workflow_dispatch:
+
+permissions:
+  issues: write
+  pull-requests: write
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@v9
+        with:
+          stale-issue-message: "This issue is stale because it has been open for 60 days with no activity."
+          stale-pr-message: "This PR is stale because it has been open for 60 days with no activity."
+          days-before-stale: 60
+          days-before-close: 7

package/.husky/commit-msg

@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+npx --no -- commitlint --edit "$1"

package/.nvmrc

@@ -0,0 +1 @@
+v24

package/.prettierignore

@@ -0,0 +1,3 @@
+*-lock.json
+dist
+coverage

package/CHANGELOG.md

@@ -0,0 +1,155 @@
+# CHANGELOG
+
+## UNRELEASED
+
+- feat(deps): Add [conventional commits](https://www.conventionalcommits.org/en/v1.0.0/) to the repo
+
+## 7.1.2
+
+- Update dependencies
+  - @types/jest to 30.0.0
+  - @vitest/coverage-v8 to 4.0.16
+  - chai to 6.2.2
+  - eslint-plugin-prettier to 5.5.4
+  - happy-dom to 20.0.11
+  - prettier to 3.7.4
+  - typescript to 5.9.3
+  - vitest to 4.0.16
+- Update Node to v24
+- Add @types/node 24.0.0
+
+## 7.1.1
+
+- DevDependency Changes
+  - happy-dom to 15.11.6
+
+- Update (sub-)dependencies
+  - cross-spawn to 7.0.6
+  - micromatch to 4.0.8
+  - vite to 4.5.5
+
+## 7.1.0
+
+- Updated to handle back-slashes
+
+## 7.0.4
+
+- Updates get-func-name to 2.0.2
+
+## 7.0.3
+
+- Dependencies
+  - Update braces to 3.0.3
+
+## 7.0.2
+
+- Improve sanitization of whitespace escapes
+
+## 7.0.1
+
+- Improve sanitization of HTML entities
+
+## 7.0.0
+
+- Move constant declarations from index file to `constants.ts` file
+- Update to node v18
+
+- Dev Dependency Updates
+  - Update to TypeScript 5
+  - Other minor dependency updates
+
+## 6.0.4
+
+- Add additional null byte sanitization prior to html decoding (#48)
+
+## 6.0.3
+
+- Add null check to beginning of `sanitizeUrl` function ([#54](https://github.com/braintree/sanitize-url/issues/54))
+
+## 6.0.2
+
+- Fix issue where urls in the form `https://example.com

/something` were not properly sanitized
+
+## 6.0.1
+
+- Fix issue where urls in the form `javascript:alert('xss');` were not properly sanitized
+- Fix issue where urls in the form `javasc	ript:alert('XSS');` were not properly sanitized
+
+## 6.0.0
+
+- BREAKING CHANGES
+  - Decode HTML characters automatically that would result in an XSS vulnerability when rendering links via a server rendered HTML file
+
+```js
+// decodes to javacript:alert('XSS')
+const vulnerableUrl =
+  "&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041";
+
+sanitizeUrl(vulnerableUrl); // 'about:blank'
+
+const okUrl = "https://example.com/" + vulnerableUrl;
+
+// since the javascript bit is in the path instead of the protocol
+// this is successfully sanitized
+sanitizeUrl(okUrl); // 'https://example.com/javascript:alert('XSS');
+```
+
+## 5.0.2
+
+- Fix issue where certain invisible white space characters were not being sanitized (#35)
+
+## 5.0.1
+
+- Fix issue where certain safe characters were being filtered out (#31 thanks @akirchmyer)
+
+## 5.0.0
+
+- BREAKING CHANGES
+  - Sanitize vbscript urls (thanks @vicnicius)
+
+## 4.1.1
+
+- Fixup path to type declaration (closes #25)
+
+## 4.1.0
+
+- Add typescript types
+
+## 4.0.1
+
+- Fix issue where urls with accented characters were incorrectly sanitized
+
+## 4.0.0
+
+- BREAKING CHANGES
+  - Protocol-less urls (ie: `www.example.com`) will be sanitised and passed on instead of sending out `about:blank` (Thanks @chawes13 #18)
+
+## 3.1.0
+
+- Trim whitespace from urls
+
+## 3.0.0
+
+- BREAKING CHANGES
+  - Replace blank strings with about:blank
+  - Replace null values with about:blank
+
+## 2.1.0
+
+- Allow relative urls to be sanitized
+
+## 2.0.2
+
+- Sanitize malicious URLs that begin with `\s`
+
+## 2.0.1
+
+- Sanitize malicious URLs that begin with %20
+
+## 2.0.0
+
+- sanitize data: urls
+
+## 1.0.0
+
+- sanitize javascript: urls

package/CONTRIBUTING.md

@@ -0,0 +1,79 @@
+# Contributing
+
+Thanks for considering contributing to this project. Ways you can help:
+
+- [Create a pull request](https://help.github.com/articles/creating-a-pull-request)
+- [Add an issue](https://github.com/ez1219/sanitize-url/issues)
+
+## Development
+
+Clone this repo, then install the project's dependencies:
+
+```
+npm install
+```
+
+## Branch and PR Lifecycle
+
+To keep the repository healthy, an automated workflow runs weekly:
+
+- **Branches**: flagged after 21 days of inactivity; deleted 7 days later if
+  still inactive. To keep a branch, add new commits or remove the bot's comment.
+- **Pull requests**: commented on after 14 days of inactivity; closed 7 days
+  later if still inactive. Closed PRs can be reopened at any time.
+- **Issues**: commented on after 14 days of inactivity; closed 7 days later if
+  still inactive.
+
+You can open a fresh PR or issue at any time if automated cleanup closes yours.
+
+## Tests
+
+```
+npm test
+```
+
+### Test Stability, Quarantine & Remediation Policy
+
+Flaky tests are any test that passes and fails intermittently without code changes (this could be due to things like timeouts, inconsistent return values, poor assertions, etc). Flaky tests erode confidence in the test suite and slow down development. This section defines how we detect, quarantine, and remediate them.
+
+#### Detection
+
+- **Automatic retries**: Jest unit tests can be configured to automatically retry on failure via `jest.retryTimes()`. Playwright integration tests (where applicable) have retries configured per-project. A test that fails once but passes on retry can be considered as potentially flaky.
+- **Repeat failures**: If a test fails intermittently across multiple CI runs or PRs, it should be reported by opening a GitHub issue with the `flaky-test` label. Include the test name, file path, failure frequency, and any relevant error output.
+
+#### Quarantine
+
+When a test is confirmed flaky:
+
+1. **Open a tracking issue** in GitHub Issues. Use the `flaky-test` label and include:
+   - Test file path and test name
+   - Observed failure rate and pattern (e.g., "fails ~10% of runs", "only in CI")
+   - Stack trace or error message
+2. **Skip the test** using `.skip` and add a comment referencing the tracking issue:
+
+   ```javascript
+   // Quarantined: flaky due to timing sensitivity (https://github.com/braintree/sanitize-url/issues/123)
+   it.skip("should handle the edge case", function () {
+     // ...
+   });
+   ```
+
+   For `describe` blocks with multiple flaky tests, you may quarantine the entire block:
+
+   ```javascript
+   // Quarantined: intermittent failures under load (https://github.com/braintree/sanitize-url/issues/123)
+   describe.skip("feature under investigation", function () {
+     // ...
+   });
+   ```
+
+3. **Skipped tests are excluded from coverage reporting.** Since quarantined tests do not execute, their associated source code is not counted toward coverage metrics. This is expected and acceptable while the test is in quarantine.
+
+#### Remediation SLA
+
+Quarantined tests must be remedied within **30 days** of being quarantined. Remediation means one of the following:
+
+- **Fixed**: The root cause is identified and corrected, the `.skip` is removed, and the test passes reliably.
+- **Deleted**: If the test is no longer valuable or the feature it covers has changed, delete the test and close the tracking issue.
+
+If a quarantined test exceeds **14 days** without progress, it should be escalated and prioritized. Tests that remain skipped indefinitely are not acceptable.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Braintree
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.