@gcforms/editor 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -5,6 +5,22 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.5] - 2025-06-23
+
+### Changed
+
+- Update Yarn to version 4.9.2
+- Update Lexical to version 0.32.0
+
+## [1.0.4] - 2025-06-02
+
+### Changed
+
+- Bumped Lexical version to 0.31.2
+- Refactored URL validation and sanitization 
+- Allow mailto: links
+- Wrote unit tests for URL utils
+
 ## [1.0.3] - 2025-05-13
 
 ### Changed

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@gcforms/editor",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "author": "Canadian Digital Service",
   "license": "MIT",
   "publishConfig": {
     "access": "public"
   },
-  "packageManager": "yarn@4.6.0",
+  "packageManager": "yarn@4.9.2",
   "dependencies": {
-    "@lexical/react": "^0.31.1",
-    "lexical": "^0.31.1"
+    "@lexical/react": "^0.32.0",
+    "lexical": "^0.32.0"
   },
   "peerDependencies": {
     "react": "^19.1.0",

package/src/utils/url.test.ts

@@ -0,0 +1,103 @@
+import { sanitizeUrl, isValidUrl } from "./url";
+
+describe("sanitizeUrl", () => {
+  it("returns safe http/https URLs unchanged", () => {
+    expect(sanitizeUrl("http://example.com")).toBe("http://example.com");
+    expect(sanitizeUrl("https://example.com")).toBe("https://example.com");
+  });
+
+  it("returns safe mailto", () => {
+    expect(sanitizeUrl("mailto:test@example.com")).toBe("mailto:test@example.com");
+  });
+
+  it("returns relative URLs unchanged", () => {
+    expect(sanitizeUrl("/relative/path")).toBe("/relative/path");
+    expect(sanitizeUrl("foo/bar")).toBe("foo/bar");
+    expect(sanitizeUrl("index.html")).toBe("index.html");
+  });
+
+  it("trims whitespace from URLs", () => {
+    expect(sanitizeUrl("  http://example.com  ")).toBe("http://example.com");
+    expect(sanitizeUrl("   /foo/bar  ")).toBe("/foo/bar");
+  });
+
+  it("returns about:blank for unsafe URLs (does not sanitize)", () => {
+    expect(sanitizeUrl("javascript:alert(1)")).toBe("about:blank");
+    expect(sanitizeUrl("data:text/html;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==")).toBe(
+      "about:blank"
+    );
+  });
+
+  it("returns trimmed input for non-URL strings", () => {
+    expect(sanitizeUrl("not a url")).toBe("not a url");
+    expect(sanitizeUrl("   not a url   ")).toBe("not a url");
+  });
+
+  it("returns about:blank for unsupported protocols", () => {
+    expect(sanitizeUrl("ftp://example.com")).toBe("about:blank");
+  });
+
+  it("handles empty string", () => {
+    expect(sanitizeUrl("")).toBe("");
+  });
+});
+
+describe("isValidUrl", () => {
+  it("returns true for valid http/https URLs", () => {
+    expect(isValidUrl("http://example.com")).toBe(true);
+    expect(isValidUrl("https://sub.domain.com/path?query=1")).toBe(true);
+  });
+
+  it("returns true for valid mailto URLs", () => {
+    expect(isValidUrl("mailto:test@example.com")).toBe(true);
+  });
+
+  it("returns true for valid tel URLs", () => {
+    expect(isValidUrl("tel:+1234567890")).toBe(true);
+    expect(isValidUrl("tel:123-456-7890")).toBe(true);
+    expect(isValidUrl("tel:(123)456-7890")).toBe(true);
+  });
+
+  it("returns true for valid sms URLs", () => {
+    expect(isValidUrl("sms:+1234567890")).toBe(true);
+    expect(isValidUrl("sms:123-456-7890")).toBe(true);
+    expect(isValidUrl("sms:(123)456-7890")).toBe(true);
+  });
+
+  it("returns false for invalid URLs", () => {
+    expect(isValidUrl("notaurl")).toBe(false);
+    expect(isValidUrl("http:/bad")).toBe(false);
+    expect(isValidUrl("ftp://example.com")).toBe(false); // ftp is not in regexp
+    expect(isValidUrl("javascript:alert(1)")).toBe(false);
+    expect(isValidUrl("data:image/png;base64,abc")).toBe(false);
+    expect(isValidUrl("tel:")).toBe(false);
+    expect(isValidUrl("sms:")).toBe(false);
+    expect(isValidUrl("tel:abc-def-ghij")).toBe(false);
+    expect(isValidUrl("sms:abc-def-ghij")).toBe(false);
+  });
+
+  it("returns false for empty string", () => {
+    expect(isValidUrl("")).toBe(false);
+  });
+
+  it("returns true for mailto with query params", () => {
+    expect(isValidUrl("mailto:user@example.com?subject=Hello")).toBe(true);
+  });
+
+  it("returns false for malformed mailto addresses", () => {
+    expect(isValidUrl("mailto:user@")).toBe(false);
+    expect(isValidUrl("mailto:@example.com")).toBe(false);
+    expect(isValidUrl("mailto:")).toBe(false);
+  });
+
+  it("returns false for URLs with internal whitespace", () => {
+    expect(isValidUrl("http://exa mple.com")).toBe(false);
+    expect(isValidUrl("mailto:test@ example.com")).toBe(false);
+    expect(isValidUrl("tel:123 456 7890")).toBe(false);
+    expect(isValidUrl("sms:123 456 7890")).toBe(false);
+  });
+
+  it("returns false for internationalized domain names (unicode)", () => {
+    expect(isValidUrl("http://exämple.com")).toBe(false);
+  });
+});

package/src/utils/url.ts

@@ -6,25 +6,29 @@
  *
  */
 
-export function sanitizeUrl(url: string): string {
-  /** A pattern that matches safe  URLs. */
-  const SAFE_URL_PATTERN = /^(?:(?:https?|mailto|ftp|tel|file|sms):|[^&:/?#]*(?:[/?#]|$))/gi;
-
-  /** A pattern that matches safe data URLs. */
-  const DATA_URL_PATTERN =
-    /^data:(?:image\/(?:bmp|gif|jpeg|jpg|png|tiff|webp)|video\/(?:mpeg|mp4|ogg|webm)|audio\/(?:mp3|oga|ogg|opus));base64,[a-z0-9+/]+=*$/i;
-
-  url = String(url).trim();
+const SUPPORTED_URL_PROTOCOLS = new Set(["http:", "https:", "mailto:", "tel:", "sms:"]);
 
-  if (url.match(SAFE_URL_PATTERN) || url.match(DATA_URL_PATTERN)) return url;
+export function sanitizeUrl(url: string): string {
+  try {
+    const parsedUrl = new URL(url);
 
-  return url;
+    if (!SUPPORTED_URL_PROTOCOLS.has(parsedUrl.protocol)) {
+      return "about:blank";
+    }
+  } catch {
+    return url.trim();
+  }
+  return url.trim();
 }
 
 /**
- * A pattern that matches a valid URL.
+ * Validates if a string is a well-formed URL.
+ * Supports http, https, mailto, tel, and sms protocols.
  */
-const urlRegExp = new RegExp(/^(https?:\/\/)?([a-zA-Z0-9-]{1,63}\.)+[a-zA-Z]{2,}(\/[^\s]*)?$/);
+const urlRegExp = new RegExp(
+  /^(https?:\/\/([a-zA-Z0-9-]{1,63}\.)+[a-zA-Z]{2,}(\/[^\s]*)?|mailto:[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}(\?[^\s]*)?|tel:\+?[0-9\-().]{3,}|sms:\+?[0-9\-().]{3,})$/
+);
+
 export function isValidUrl(url: string): boolean {
   return urlRegExp.test(url);
 }