@instructure/platform-sanitize 0.3.1 → 0.3.4

package/dist/index.js

@@ -172,41 +172,44 @@ const d = /* @__PURE__ */ new Set([
   RETURN_TRUSTED_TYPE: !0
 };
 let i = null;
-function g() {
+function u() {
   return i || (i = typeof a == "function" ? a(window) : a, i.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("style")) return;
-    const e = t.style, o = [];
-    for (let r = 0; r < e.length; r++) {
-      const n = e.item(r);
-      d.has(n) || o.push(n);
+    const e = t.style, r = [];
+    for (let o = 0; o < e.length; o++) {
+      const n = e.item(o);
+      d.has(n) || r.push(n);
     }
-    for (const r of o) e.removeProperty(r);
+    for (const o of r) e.removeProperty(o);
     e.length === 0 && t.removeAttribute("style");
   }), i.addHook("uponSanitizeAttribute", (t, e) => {
     c.has(e.attrName) && l.test(e.attrValue) && (e.keepAttr = !1);
   }), i.addHook("afterSanitizeAttributes", (t) => {
     if (!(t instanceof Element) || !t.hasAttribute("srcset")) return;
-    (t.getAttribute("srcset") ?? "").split(",").map((r) => r.trim().split(/\s+/)[0]).some((r) => l.test(r)) && t.removeAttribute("srcset");
+    (t.getAttribute("srcset") ?? "").split(",").map((o) => o.trim().split(/\s+/)[0]).some((o) => l.test(o)) && t.removeAttribute("srcset");
   }), i);
 }
-function p(t) {
+function h(t) {
   if (typeof window > "u")
     throw new Error("sanitizeHtml requires a DOM environment (window is not defined)");
-  return g().sanitize(t ?? "", f);
+  return u().sanitize(t ?? "", f);
 }
-const m = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), s = "http://platform-sanitize.invalid/", u = /^\s*\/\//;
-function h(t) {
+const g = /* @__PURE__ */ new Set(["http:", "https:", "mailto:", "tel:"]), s = "http://platform-sanitize.invalid/", p = /^\s*\/\//, b = (
+  // biome-ignore lint/suspicious/noControlCharactersInRegex: intentional security guard
+  /^[\u0000-\u0020\u007F-\u00A0\u2000-\u200F\u2028\u2029\u202F\u205F\u2060\u3000\uFEFF]*(?:javascript|data|vbscript|file):/i
+);
+function w(t) {
   if (!t || !t.trim()) return "about:blank";
   const e = t.replace(/\\/g, "/");
-  if (u.test(e)) return "about:blank";
+  if (p.test(e) || b.test(e)) return "about:blank";
   try {
-    const o = new URL(e, s);
-    return m.has(o.protocol) ? o.href.startsWith(s) ? t : o.href : "about:blank";
+    const r = new URL(e, s);
+    return !g.has(r.protocol) || (r.protocol === "http:" || r.protocol === "https:") && (r.username || r.password) ? "about:blank" : r.href.startsWith(s) ? t : e.replace(/[\x00-\x1F]/g, "").replace(/%0[ad]/gi, "");
   } catch {
     return "about:blank";
   }
 }
 export {
-  p as sanitizeHtml,
-  h as sanitizeUrl
+  h as sanitizeHtml,
+  w as sanitizeUrl
 };

package/dist/sanitizeUrl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AAwBA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAiBlE"}
+{"version":3,"file":"sanitizeUrl.d.ts","sourceRoot":"","sources":["../src/sanitizeUrl.ts"],"names":[],"mappings":"AA2CA,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAiClE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@instructure/platform-sanitize",
-  "version": "0.3.1",
+  "version": "0.3.4",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -18,11 +18,11 @@
     "access": "public"
   },
   "peerDependencies": {
-    "dompurify": "^3.0.0"
+    "dompurify": "^3.4.0"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.0.17",
-    "dompurify": "^3.0.0",
+    "dompurify": "^3.4.0",
     "jsdom": "^25.0.0",
     "typescript": "^5.3.0",
     "vite": "^6.0.0",