@rowsncolumns/utils 9.2.35 → 9.2.36

package/dist/cjs/string.d.ts

@@ -64,9 +64,16 @@ export declare const supplant: (s: string, o: Record<string, any>) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */

package/dist/cjs/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAKF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAY/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/cjs/string.js

@@ -213,21 +213,40 @@ var supplant = function (s, o) {
 };
 exports.supplant = supplant;
 // RFC 3986 scheme: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":"
-var URL_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+var URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
+// Schemes an external hyperlink is allowed to carry. Anything else with an
+// explicit scheme (javascript:, data:, vbscript:, …) is a script/content
+// injection vector and is rejected.
+var SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */
 var normalizeExternalUrl = function (url) {
-    var trimmed = url.trim();
-    if (!trimmed ||
-        URL_SCHEME.test(trimmed) ||
-        trimmed.startsWith("//") ||
+    var trimmed = url
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return "";
+    }
+    var schemeMatch = URL_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+        return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase()) ? trimmed : "";
+    }
+    if (trimmed.startsWith("//") ||
         trimmed.startsWith("#") ||
         trimmed.startsWith("/")) {
         return trimmed;

package/dist/esm/string.d.ts

@@ -64,9 +64,16 @@ export declare const supplant: (s: string, o: Record<string, any>) => string;
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */

package/dist/esm/string.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAKF;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAY/C,CAAC"}
+{"version":3,"file":"string.d.ts","sourceRoot":"","sources":["../../string.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAK3E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,GAAI,MAAM,aAAa,KAAG,SAKvD,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,SAAS,MAAM,EACf,UAAS;IACP,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACjB,KACL,aAAa,GAAG,IAuDlB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,GAAI,SAAS,MAAM,uBAEvD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,GAAI,SAAS,MAAM,uBAErD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,GACxB,MAAM,aAAa,GAAG,IAAI,EAC1B,0BAAwB,EACxB,uBAAqB,EACrB,sBAAoB,EACpB,mBAAiB,KAChB,MAAM,GAAG,IAiBX,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,WAAW,MAAM,GAAG,SAAS,EAC7B,OAAO,SAAS,WAUjB,CAAC;AAGF,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,GAAG,SAAS,uBASzD,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,GAAI,MAAM,MAAM,GAAG,SAAS,uBAgB3D,CAAC;AAKF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,GAAI,KAAK,MAAM,WAI3C,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,wBAAwB,GACnC,OAAO,aAAa,EACpB,MAAK,aAAa,GAAG,IAAY,KAChC,SAQF,CAAC;AAEF,eAAO,MAAM,QAAQ,GAAI,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,WAKzD,CAAC;AAUF;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,oBAAoB,GAAI,KAAK,MAAM,WAoB/C,CAAC"}

package/dist/esm/string.js

@@ -190,21 +190,40 @@ export const supplant = (s, o) => {
     });
 };
 // RFC 3986 scheme: ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":"
-const URL_SCHEME = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
+const URL_SCHEME = /^([a-zA-Z][a-zA-Z0-9+.-]*):/;
+// Schemes an external hyperlink is allowed to carry. Anything else with an
+// explicit scheme (javascript:, data:, vbscript:, …) is a script/content
+// injection vector and is rejected.
+const SAFE_URL_SCHEMES = new Set(["http", "https", "mailto", "tel", "ftp"]);
 /**
  * Normalize an external hyperlink target for the browser. A stored URL
  * without a scheme ("paradigm.xyz") would otherwise be resolved relative to
- * the current page. Prefixes https:// unless the URL already has a scheme
- * (https:, mailto:, tel:, …), is protocol-relative ("//host"), or is a
- * fragment/path reference.
+ * the current page. Prefixes https:// unless the URL already has a scheme,
+ * is protocol-relative ("//host"), or is a fragment/path reference.
+ *
+ * URLs with an explicit scheme are only passed through when the scheme is in
+ * the safe allowlist (http, https, mailto, tel, ftp — case-insensitive);
+ * anything else returns "" so it can never reach window.open/href sinks.
+ * Mirrors browser URL canonicalization before matching the scheme: embedded
+ * ASCII tab/newline characters are removed and leading/trailing C0 controls
+ * and whitespace are stripped, so obfuscations like "Java\tScript:" or a
+ * leading "\n" cannot smuggle a dangerous scheme past the check.
  * @param url
  * @returns
  */
 export const normalizeExternalUrl = (url) => {
-    const trimmed = url.trim();
-    if (!trimmed ||
-        URL_SCHEME.test(trimmed) ||
-        trimmed.startsWith("//") ||
+    const trimmed = url
+        .replace(/[\t\n\r]/g, "")
+        .replace(/^[\u0000-\u0020]+|[\u0000-\u0020]+$/g, "")
+        .trim();
+    if (!trimmed) {
+        return "";
+    }
+    const schemeMatch = URL_SCHEME.exec(trimmed);
+    if (schemeMatch) {
+        return SAFE_URL_SCHEMES.has(schemeMatch[1].toLowerCase()) ? trimmed : "";
+    }
+    if (trimmed.startsWith("//") ||
         trimmed.startsWith("#") ||
         trimmed.startsWith("/")) {
         return trimmed;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rowsncolumns/utils",
-  "version": "9.2.35",
+  "version": "9.2.36",
   "author": "Vinay M",
   "license": "SEE LICENSE IN LICENSE.md",
   "main": "./dist/cjs/index.js",