@ez1219/sanitize-url 7.1.2-rc.0

package/README.md

@@ -0,0 +1,39 @@
+# sanitize-url
+
+## Installation
+
+```sh
+npm install -S @ez1219/sanitize-url
+```
+
+## Usage
+
+```js
+var sanitizeUrl = require("@ez1219/sanitize-url").sanitizeUrl;
+
+sanitizeUrl("https://example.com"); // 'https://example.com'
+sanitizeUrl("http://example.com"); // 'http://example.com'
+sanitizeUrl("www.example.com"); // 'www.example.com'
+sanitizeUrl("mailto:hello@example.com"); // 'mailto:hello@example.com'
+sanitizeUrl(
+  "https&#0000058//example.com",
+); // https://example.com
+
+sanitizeUrl("javascript:alert(document.domain)"); // 'about:blank'
+sanitizeUrl("jAvasCrIPT:alert(document.domain)"); // 'about:blank'
+sanitizeUrl(decodeURIComponent("JaVaScRiP%0at:alert(document.domain)")); // 'about:blank'
+// HTML encoded javascript:alert('XSS')
+sanitizeUrl(
+  "&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041",
+); // 'about:blank'
+```
+
+## Testing
+
+This library uses [Vitest](https://vitest.dev/). All testing dependencies
+will be installed upon `npm install` and the test suite can be executed with
+`npm test`. Running the test suite will also run lint checks upon exiting.
+
+    npm test
+
+To generate a coverage report, use `npm run coverage`.

package/SECURITY.md

@@ -0,0 +1,41 @@
+# Security Policy
+
+This repository adheres to the [PayPal Vulnerability Reporting Policy](https://hackerone.com/paypal).
+
+## Reporting a Vulnerability
+
+If you think you have found a vulnerability in this repository, please report it to us through coordinated disclosure.
+
+**Please do not report security vulnerabilities through public issues, discussions, or pull requests.**
+
+Instead, report it using one of the following ways:
+
+- Email the PayPal Security Team at [security@paypal.com](mailto:security@paypal.com)
+- Submit through the [PayPal Bug Bounty Program](https://hackerone.com/paypal) on HackerOne
+- Report a [vulnerability](https://github.com/ez1219/sanitize-url/security/advisories/new) directly via private vulnerability reporting on GitHub
+
+Please include the following in your report:
+
+- The type of issue and affected version(s)
+- Step-by-step instructions to reproduce the issue
+- Impact of the issue and how an attacker might exploit it
+
+## Supported Security Updates
+
+Only the latest release receives security patches and new versions in the case of a security issue.
+
+## Disclosure Policy
+
+We are committed to working with security researchers in good faith. To support responsible disclosure, our team will:
+
+- Acknowledge your report in a timely manner
+- Keep you informed of our progress toward a fix
+- Notify you before any public disclosure
+
+We ask that you:
+
+- Do not publicly disclose the issue before it has been resolved
+- Avoid accessing, modifying, or deleting data that does not belong to you
+- Make a good faith effort to avoid disruption to production systems
+
+We appreciate responsible disclosure and your efforts to keep Braintree SDK users safe.

package/commitlint.config.js

@@ -0,0 +1,70 @@
+// commitlint.config.js
+module.exports = {
+  extends: ["@commitlint/config-conventional"],
+
+  // Customize rules
+  rules: {
+    // Type must be one of the specified values
+    "type-enum": [
+      2, // Error level (0=off, 1=warn, 2=error)
+      "always",
+      [
+        "feat", // New feature
+        "fix", // Bug fix
+        "review",
+        "docs", // Documentation
+        "style", // Formatting
+        "refactor", // Code restructuring
+        "perf", // Performance
+        "test", // Tests
+        "build", // Build system
+        "dx", // Developer experience
+        "ci", // CI configuration
+        "chore", // Maintenance
+        "revert", // Revert commit
+      ],
+    ],
+
+    "scope-enum": [
+      2,
+      "always",
+      [
+        "american-express",
+        "apple-pay",
+        "client",
+        "data-collector",
+        "fastlane",
+        "google-payment",
+        "hosted-fields",
+        "instant-verification",
+        "local-payment",
+        "payment-ready",
+        "payment-request",
+        "paypal-checkout",
+        "paypal-checkout-v6",
+        "sepa",
+        "three-d-secure",
+        "us-bank-account",
+        "vault-manager",
+        "venmo",
+        "deps",
+        "dev-deps",
+        "other",
+      ],
+    ],
+    // Scope is optional but recommended
+    "scope-empty": [1, "never"],
+
+    // Subject configuration
+    "subject-empty": [2, "never"],
+    "subject-case": [0, "always", "sentence-case"],
+    "subject-full-stop": [1, "never", "."],
+    "subject-max-length": [2, "always", 85],
+
+    // Body configuration
+    "body-max-line-length": [2, "always", 100],
+
+    // Footer configuration
+    "footer-max-line-length": [2, "always", 100],
+  },
+};

package/dist/constants.d.ts

@@ -0,0 +1,8 @@
+export declare const invalidProtocolRegex: RegExp;
+export declare const htmlEntitiesRegex: RegExp;
+export declare const htmlCtrlEntityRegex: RegExp;
+export declare const ctrlCharactersRegex: RegExp;
+export declare const urlSchemeRegex: RegExp;
+export declare const whitespaceEscapeCharsRegex: RegExp;
+export declare const relativeFirstCharacters: string[];
+export declare const BLANK_URL = "about:blank";

package/dist/constants.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BLANK_URL = exports.relativeFirstCharacters = exports.whitespaceEscapeCharsRegex = exports.urlSchemeRegex = exports.ctrlCharactersRegex = exports.htmlCtrlEntityRegex = exports.htmlEntitiesRegex = exports.invalidProtocolRegex = void 0;
+exports.invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im;
+exports.htmlEntitiesRegex = /&#(\w+)(^\w|;)?/g;
+exports.htmlCtrlEntityRegex = /&(newline|tab);/gi;
+exports.ctrlCharactersRegex = /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
+exports.urlSchemeRegex = /^.+(:|:)/gim;
+exports.whitespaceEscapeCharsRegex = /(\\|%5[cC])((%(6[eE]|72|74))|[nrt])/g;
+exports.relativeFirstCharacters = [".", "/"];
+exports.BLANK_URL = "about:blank";

package/dist/index.d.ts

@@ -0,0 +1 @@
+export declare function sanitizeUrl(url?: string): string;

package/dist/index.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeUrl = sanitizeUrl;
+var constants_1 = require("./constants");
+function isRelativeUrlWithoutProtocol(url) {
+    return constants_1.relativeFirstCharacters.indexOf(url[0]) > -1;
+}
+function decodeHtmlCharacters(str) {
+    var removedNullByte = str.replace(constants_1.ctrlCharactersRegex, "");
+    return removedNullByte.replace(constants_1.htmlEntitiesRegex, function (match, dec) {
+        return String.fromCharCode(dec);
+    });
+}
+function isValidUrl(url) {
+    if (typeof URL !== "undefined" && typeof URL.canParse === "function") {
+        return URL.canParse(url);
+    }
+    try {
+        return Boolean(new URL(url));
+    }
+    catch (_a) {
+        return false;
+    }
+}
+function decodeURI(uri) {
+    try {
+        return decodeURIComponent(uri);
+    }
+    catch (e) {
+        // Ignoring error
+        // It is possible that the URI contains a `%` not associated
+        // with URI/URL-encoding.
+        return uri;
+    }
+}
+function sanitizeUrl(url) {
+    if (!url) {
+        return constants_1.BLANK_URL;
+    }
+    var charsToDecode;
+    var decodedUrl = decodeURI(url.trim());
+    do {
+        decodedUrl = decodeHtmlCharacters(decodedUrl)
+            .replace(constants_1.htmlCtrlEntityRegex, "")
+            .replace(constants_1.ctrlCharactersRegex, "")
+            .replace(constants_1.whitespaceEscapeCharsRegex, "")
+            .trim();
+        decodedUrl = decodeURI(decodedUrl);
+        charsToDecode =
+            decodedUrl.match(constants_1.ctrlCharactersRegex) ||
+                decodedUrl.match(constants_1.htmlEntitiesRegex) ||
+                decodedUrl.match(constants_1.htmlCtrlEntityRegex) ||
+                decodedUrl.match(constants_1.whitespaceEscapeCharsRegex);
+    } while (charsToDecode && charsToDecode.length > 0);
+    var sanitizedUrl = decodedUrl;
+    if (!sanitizedUrl) {
+        return constants_1.BLANK_URL;
+    }
+    if (isRelativeUrlWithoutProtocol(sanitizedUrl)) {
+        return sanitizedUrl;
+    }
+    // Remove any leading whitespace before checking the URL scheme
+    var trimmedUrl = sanitizedUrl.trimStart();
+    var urlSchemeParseResults = trimmedUrl.match(constants_1.urlSchemeRegex);
+    if (!urlSchemeParseResults) {
+        return sanitizedUrl;
+    }
+    var urlScheme = urlSchemeParseResults[0].toLowerCase().trim();
+    if (constants_1.invalidProtocolRegex.test(urlScheme)) {
+        return constants_1.BLANK_URL;
+    }
+    var backSanitized = trimmedUrl.replace(/\\/g, "/");
+    // Handle special cases for mailto: and custom deep-link protocols
+    if (urlScheme === "mailto:" || urlScheme.includes("://")) {
+        return backSanitized;
+    }
+    // For http and https URLs, perform additional validation
+    if (urlScheme === "http:" || urlScheme === "https:") {
+        if (!isValidUrl(backSanitized)) {
+            return constants_1.BLANK_URL;
+        }
+        var url_1 = new URL(backSanitized);
+        url_1.protocol = url_1.protocol.toLowerCase();
+        url_1.hostname = url_1.hostname.toLowerCase();
+        return url_1.toString();
+    }
+    return backSanitized;
+}

package/package.json

@@ -0,0 +1,56 @@
+{
+  "name": "@ez1219/sanitize-url",
+  "version": "7.1.2-rc.0",
+  "description": "A url sanitizer",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "author": "",
+  "scripts": {
+    "prepublishOnly": "npm run build",
+    "prebuild": "prettier --write .",
+    "build": "tsc --declaration",
+    "lint": "eslint --ext js,ts .",
+    "posttest": "npm run lint",
+    "test": "vitest",
+    "coverage": "vitest run --coverage",
+    "prepare": "husky",
+    "commit": "cz"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ez1219/sanitize-url.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "keywords": [],
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/ez1219/sanitize-url/issues"
+  },
+  "homepage": "https://github.com/ez1219/sanitize-url#readme",
+  "devDependencies": {
+    "@commitlint/cli": "^20.5.0",
+    "@commitlint/config-conventional": "^20.5.0",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.0.0",
+    "@typescript-eslint/eslint-plugin": "^5.54.1",
+    "@vitest/coverage-v8": "^4.0.16",
+    "chai": "^6.2.2",
+    "commitizen": "^4.3.1",
+    "cz-customizable": "^7.5.4",
+    "eslint": "^8.36.0",
+    "eslint-config-braintree": "^6.0.0-typescript-prep-rc.2",
+    "eslint-plugin-prettier": "^5.5.4",
+    "happy-dom": "^20.0.11",
+    "husky": "^9.1.7",
+    "prettier": "^3.7.4",
+    "typescript": "^5.9.3",
+    "vitest": "^4.0.16"
+  },
+  "config": {
+    "commitizen": {
+      "path": "./node_modules/cz-customizable"
+    }
+  }
+}

package/src/__tests__/index.test.ts

@@ -0,0 +1,299 @@
+/* eslint-disable no-script-url */
+import { sanitizeUrl } from "..";
+import { BLANK_URL } from "../constants";
+
+describe("sanitizeUrl", () => {
+  it("does not alter http URLs with alphanumeric characters", () => {
+    expect(sanitizeUrl("http://example.com/path/to:something")).toBe(
+      "http://example.com/path/to:something",
+    );
+  });
+
+  it("does not alter http URLs with ports with alphanumeric characters", () => {
+    expect(sanitizeUrl("http://example.com:4567/path/to:something")).toBe(
+      "http://example.com:4567/path/to:something",
+    );
+  });
+
+  it("does not alter https URLs with alphanumeric characters", () => {
+    expect(sanitizeUrl("https://example.com")).toBe("https://example.com/");
+  });
+
+  it("does not alter https URLs with ports with alphanumeric characters", () => {
+    expect(sanitizeUrl("https://example.com:4567/path/to:something")).toBe(
+      "https://example.com:4567/path/to:something",
+    );
+  });
+
+  it("does not alter relative-path reference URLs with alphanumeric characters", () => {
+    expect(sanitizeUrl("./path/to/my.json")).toBe("./path/to/my.json");
+  });
+
+  it("does not alter absolute-path reference URLs with alphanumeric characters", () => {
+    expect(sanitizeUrl("/path/to/my.json")).toBe("/path/to/my.json");
+  });
+
+  it("does not alter protocol-less network-path URLs with alphanumeric characters", () => {
+    expect(sanitizeUrl("//google.com/robots.txt")).toBe(
+      "//google.com/robots.txt",
+    );
+  });
+
+  it("does not alter protocol-less URLs with alphanumeric characters", () => {
+    expect(sanitizeUrl("www.example.com")).toBe("www.example.com");
+  });
+
+  it("does not alter deep-link urls with alphanumeric characters", () => {
+    expect(sanitizeUrl("com.braintreepayments.demo://example")).toBe(
+      "com.braintreepayments.demo://example",
+    );
+  });
+
+  it("does not alter mailto urls with alphanumeric characters", () => {
+    expect(sanitizeUrl("mailto:test@example.com?subject=hello+world")).toBe(
+      "mailto:test@example.com?subject=hello+world",
+    );
+  });
+
+  it("does not alter urls with accented characters", () => {
+    expect(sanitizeUrl("www.example.com/with-áccêntš")).toBe(
+      "www.example.com/with-áccêntš",
+    );
+  });
+
+  it("does not strip harmless unicode characters", () => {
+    expect(sanitizeUrl("www.example.com/лот.рфшишкиü–")).toBe(
+      "www.example.com/лот.рфшишкиü–",
+    );
+  });
+
+  it("strips out ctrl chars", () => {
+    expect(
+      sanitizeUrl("www.example.com/\u200D\u0000\u001F\x00\x1F\uFEFFfoo"),
+    ).toBe("www.example.com/foo");
+  });
+
+  it(`replaces blank urls with ${BLANK_URL}`, () => {
+    expect(sanitizeUrl("")).toBe(BLANK_URL);
+  });
+
+  it(`replaces null values with ${BLANK_URL}`, () => {
+    // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+    // @ts-ignore
+    expect(sanitizeUrl(null)).toBe(BLANK_URL);
+  });
+
+  it(`replaces undefined values with ${BLANK_URL}`, () => {
+    expect(sanitizeUrl()).toBe(BLANK_URL);
+  });
+
+  it("removes whitespace from urls", () => {
+    expect(sanitizeUrl("   http://example.com/path/to:something    ")).toBe(
+      "http://example.com/path/to:something",
+    );
+  });
+
+  it("removes newline entities from urls", () => {
+    expect(sanitizeUrl("https://example.com

/something")).toBe(
+      "https://example.com/something",
+    );
+  });
+
+  it("decodes html entities", () => {
+    // all these decode to javascript:alert('xss');
+    const attackVectors = [
+      "&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041",
+      "javascript:alert('XSS')",
+      "&#x6A&#x61&#x76&#x61&#x73&#x63&#x72&#x69&#x70&#x74&#x3A&#x61&#x6C&#x65&#x72&#x74&#x28&#x27&#x58&#x53&#x53&#x27&#x29",
+      "jav	ascript:alert('XSS');",
+      "  javascript:alert('XSS');",
+      "javasc	ript: alert('XSS');",
+      "javasc&#\u0000x09;ript:alert(1)",
+      "java&&#78&#59;ewLine&newline&#59;&#59;script:alert('XSS')",
+      "java&NewLine&newline;;script:alert('XSS')",
+    ];
+
+    attackVectors.forEach((vector) => {
+      expect(sanitizeUrl(vector)).toBe(BLANK_URL);
+    });
+
+    // https://example.com/javascript:alert('XSS')
+    // since the javascript is the url path, and not the protocol,
+    // this url is technically sanitized
+    expect(
+      sanitizeUrl(
+        "https&#0000058//example.com/&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041",
+      ),
+    ).toBe("https://example.com/javascript:alert('XSS')");
+  });
+
+  it("removes whitespace escape sequences", () => {
+    const attackVectors = [
+      "javascri\npt:alert('xss')",
+      "javascri\rpt:alert('xss')",
+      "javascri\tpt:alert('xss')",
+      "javascrip\\%74t:alert('XSS')",
+      "javascrip%5c%72t:alert()",
+      "javascrip%5Ctt:alert()",
+      "javascrip%255Ctt:alert()",
+      "javascrip%25%35Ctt:alert()",
+      "javascrip%25%35%43tt:alert()",
+      "javascrip%25%32%35%25%33%35%25%34%33rt:alert()",
+      "javascrip%255Crt:alert('%25xss')",
+    ];
+
+    attackVectors.forEach((vector) => {
+      expect(sanitizeUrl(vector)).toBe(BLANK_URL);
+    });
+  });
+
+  it("backslash prefixed attack vectors", () => {
+    const attackVectors = [
+      "\fjavascript:alert()",
+      "\vjavascript:alert()",
+      "\tjavascript:alert()",
+      "\njavascript:alert()",
+      "\rjavascript:alert()",
+      "\u0000javascript:alert()",
+      "\u0001javascript:alert()",
+    ];
+
+    attackVectors.forEach((vector) => {
+      expect(sanitizeUrl(vector)).toBe(BLANK_URL);
+    });
+  });
+
+  it("reverses backslashes", () => {
+    const attack = "\\j\\av\\a\\s\\cript:alert()";
+
+    expect(sanitizeUrl(attack)).toBe("/j/av/a/s/cript:alert()");
+  });
+
+  describe("invalid protocols", () => {
+    describe.each(["javascript", "data", "vbscript"])("%s", (protocol) => {
+      it(`replaces ${protocol} urls with ${BLANK_URL}`, () => {
+        expect(sanitizeUrl(`${protocol}:alert(document.domain)`)).toBe(
+          BLANK_URL,
+        );
+      });
+
+      it(`allows ${protocol} urls that start with a letter prefix`, () => {
+        expect(sanitizeUrl(`not_${protocol}:alert(document.domain)`)).toBe(
+          `not_${protocol}:alert(document.domain)`,
+        );
+      });
+
+      it(`disallows ${protocol} urls that start with non-\w characters as a suffix for the protocol`, () => {
+        expect(sanitizeUrl(`&!*${protocol}:alert(document.domain)`)).toBe(
+          BLANK_URL,
+        );
+      });
+
+      it(`disallows ${protocol} urls that use : for the colon portion of the url`, () => {
+        expect(sanitizeUrl(`${protocol}:alert(document.domain)`)).toBe(
+          BLANK_URL,
+        );
+        expect(sanitizeUrl(`${protocol}:alert(document.domain)`)).toBe(
+          BLANK_URL,
+        );
+      });
+
+      it(`disregards capitalization for ${protocol} urls`, () => {
+        // upper case every other letter in protocol name
+        const mixedCapitalizationProtocol = protocol
+          .split("")
+          .map((character, index) => {
+            if (index % 2 === 0) {
+              return character.toUpperCase();
+            }
+            return character;
+          })
+          .join("");
+
+        expect(
+          sanitizeUrl(`${mixedCapitalizationProtocol}:alert(document.domain)`),
+        ).toBe(BLANK_URL);
+      });
+
+      it(`ignores invisible ctrl characters in ${protocol} urls`, () => {
+        const protocolWithControlCharacters = protocol
+          .split("")
+          .map((character, index) => {
+            if (index === 1) {
+              return character + "%EF%BB%BF%EF%BB%BF";
+            } else if (index === 2) {
+              return character + "%e2%80%8b";
+            }
+            return character;
+          })
+          .join("");
+
+        expect(
+          sanitizeUrl(
+            decodeURIComponent(
+              `${protocolWithControlCharacters}:alert(document.domain)`,
+            ),
+          ),
+        ).toBe(BLANK_URL);
+      });
+
+      it(`replaces ${protocol} urls with ${BLANK_URL} when url begins with %20`, () => {
+        expect(
+          sanitizeUrl(
+            decodeURIComponent(
+              `%20%20%20%20${protocol}:alert(document.domain)`,
+            ),
+          ),
+        ).toBe(BLANK_URL);
+      });
+
+      it(`replaces ${protocol} urls with ${BLANK_URL} when ${protocol} url begins with spaces`, () => {
+        expect(sanitizeUrl(`    ${protocol}:alert(document.domain)`)).toBe(
+          BLANK_URL,
+        );
+      });
+
+      it(`does not replace ${protocol}: if it is not in the scheme of the URL`, () => {
+        expect(sanitizeUrl(`http://example.com#${protocol}:foo`)).toBe(
+          `http://example.com#${protocol}:foo`,
+        );
+      });
+    });
+  });
+
+  it("replaces invalid http/https URLs with BLANK_URL", () => {
+    expect(sanitizeUrl("http://[invalid]")).toBe(BLANK_URL);
+    expect(sanitizeUrl("https://[invalid]")).toBe(BLANK_URL);
+  });
+
+  describe("when URL.canParse is undefined", () => {
+    let originalCanParse: typeof URL.canParse;
+
+    beforeEach(() => {
+      originalCanParse = URL.canParse;
+      // eslint-disable-next-line @typescript-eslint/ban-ts-comment
+      // @ts-ignore
+      URL.canParse = null;
+    });
+
+    afterEach(() => {
+      URL.canParse = originalCanParse;
+    });
+
+    it("sanitizes valid http/https URLs properly using fallback", () => {
+      expect(sanitizeUrl("http://example.com/path")).toBe(
+        "http://example.com/path",
+      );
+      expect(sanitizeUrl("https://example.com")).toBe("https://example.com/");
+    });
+
+    it("replaces invalid http/https URLs with BLANK_URL using fallback", () => {
+      expect(sanitizeUrl("http://[invalid]")).toBe(BLANK_URL);
+      expect(sanitizeUrl("https://[invalid]")).toBe(BLANK_URL);
+    });
+
+    it("replaces javascript URLs with BLANK_URL", () => {
+      expect(sanitizeUrl("javascript:alert(1)")).toBe(BLANK_URL);
+    });
+  });
+});

package/src/constants.ts

@@ -0,0 +1,10 @@
+export const invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im;
+export const htmlEntitiesRegex = /&#(\w+)(^\w|;)?/g;
+export const htmlCtrlEntityRegex = /&(newline|tab);/gi;
+export const ctrlCharactersRegex =
+  /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
+export const urlSchemeRegex = /^.+(:|:)/gim;
+export const whitespaceEscapeCharsRegex =
+  /(\\|%5[cC])((%(6[eE]|72|74))|[nrt])/g;
+export const relativeFirstCharacters = [".", "/"];
+export const BLANK_URL = "about:blank";