@withwiz/toolkit 0.3.0 → 0.3.2

package/dist/middleware/middleware-chain.js

@@ -1,9 +1,9 @@
 import {
   MiddlewareChain
-} from "../chunk-L6M4DZV2.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-FPESPW6P.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/middleware/rate-limit.js

@@ -2,14 +2,14 @@ import {
   createRateLimitMiddleware,
   rateLimitMiddleware,
   setRateLimitAdapter
-} from "../chunk-M776IH4D.js";
+} from "../chunk-6MI4XLWC.js";
 import "../chunk-KXXROUA5.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+import "../chunk-SNVGJPPX.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
-import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {
   createRateLimitMiddleware,

package/dist/middleware/response-logger.js

@@ -1,9 +1,9 @@
 import {
   responseLoggerMiddleware
-} from "../chunk-STNIT65W.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-OIRAH57Y.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/middleware/security.js

@@ -1,10 +1,10 @@
 import {
   securityMiddleware,
   validateSecurityConfiguration
-} from "../chunk-UD7YHLHI.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-QVWDWROP.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/middleware/wrappers.js

@@ -4,31 +4,31 @@ import {
   withCustomApi,
   withOptionalAuthApi,
   withPublicApi
-} from "../chunk-NWAN2VRP.js";
-import "../chunk-DC2OFQ43.js";
+} from "../chunk-NQS7UT6X.js";
 import "../chunk-62Q7DN5G.js";
-import "../chunk-L6M4DZV2.js";
-import "../chunk-M776IH4D.js";
-import "../chunk-STNIT65W.js";
-import "../chunk-UD7YHLHI.js";
-import "../chunk-5P4E6SGV.js";
-import "../chunk-NE33JZW3.js";
+import "../chunk-FPESPW6P.js";
+import "../chunk-6MI4XLWC.js";
+import "../chunk-OIRAH57Y.js";
+import "../chunk-QVWDWROP.js";
+import "../chunk-A6V6XVPZ.js";
+import "../chunk-KGHWGLED.js";
+import "../chunk-BKJPYZYO.js";
 import "../chunk-XHZ5L4FO.js";
-import "../chunk-HKJCBV3H.js";
+import "../chunk-2KDLKHTO.js";
 import "../chunk-KXXROUA5.js";
 import "../chunk-Y2JYA2AR.js";
 import "../chunk-HCF3C3AQ.js";
 import "../chunk-IYXMGIEP.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-JNB7MWG4.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
-import "../chunk-ITSXXSFN.js";
+import "../chunk-SNVGJPPX.js";
+import "../chunk-GFWGLWTS.js";
+import "../chunk-OZE5KUS3.js";
+import "../chunk-R6YVUU6I.js";
+import "../chunk-AIH3F7JV.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
-import "../chunk-2ATBAIRL.js";
-import "../chunk-AIH3F7JV.js";
-import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {
   withAdminApi,

package/dist/storage/config.d.ts

@@ -12,6 +12,9 @@ export interface ResolvedStorageConfig {
     bucketName: string;
     publicUrl?: string;
 }
+declare global {
+    var __withwiz_storage_config: ResolvedStorageConfig | undefined;
+}
 export declare function initializeStorage(config: StorageConfig): void;
 export declare function getStorageConfig(): ResolvedStorageConfig;
 export declare function resetStorage(): void;

package/dist/storage/config.js

@@ -2,7 +2,7 @@ import {
   getStorageConfig,
   initializeStorage,
   resetStorage
-} from "../chunk-YCIYDWJU.js";
+} from "../chunk-AYZJN32D.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/storage/r2-storage.js

@@ -1,12 +1,12 @@
 import {
   AppError
 } from "../chunk-KXXROUA5.js";
+import "../chunk-SNVGJPPX.js";
 import {
   getStorageConfig
-} from "../chunk-YCIYDWJU.js";
+} from "../chunk-AYZJN32D.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
-import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 
 // src/storage/r2-storage.ts

package/dist/system/cpu.js

@@ -1,10 +1,10 @@
 import {
   getCpuInfo
-} from "../chunk-GRGOD3W5.js";
-import "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-FD2TXDTO.js";
+import "../chunk-S5UCZ2T3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/system/disk.js

@@ -1,10 +1,10 @@
 import {
   getDiskInfo
-} from "../chunk-BY653UR3.js";
-import "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-6SOQUYOU.js";
+import "../chunk-S5UCZ2T3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/system/environment.js

@@ -1,16 +1,16 @@
 import {
   checkEnvironmentVariables
-} from "../chunk-2LCLLZME.js";
-import "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-V33BEN6H.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-JTPLPUI7.js";
-import "../chunk-5MBKG2ZD.js";
-import "../chunk-IQQKKUAV.js";
-import "../chunk-ITSXXSFN.js";
+} from "../chunk-WNF2RKFA.js";
+import "../chunk-S5UCZ2T3.js";
+import "../chunk-3CBGGMIY.js";
+import "../chunk-OZE5KUS3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
+import "../chunk-TFD3DSM2.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
+import "../chunk-IQQKKUAV.js";
 import "../chunk-ORMEWXMH.js";
 export {
   checkEnvironmentVariables

package/dist/system/health-check.js

@@ -1,15 +1,15 @@
 import {
   checkServiceHealth
-} from "../chunk-KAIGEZAL.js";
+} from "../chunk-BYCFXGQL.js";
 import "../chunk-OIVXOT2X.js";
-import "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-JTPLPUI7.js";
-import "../chunk-5MBKG2ZD.js";
-import "../chunk-IQQKKUAV.js";
+import "../chunk-S5UCZ2T3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
+import "../chunk-TFD3DSM2.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
+import "../chunk-IQQKKUAV.js";
 import "../chunk-ORMEWXMH.js";
 export {
   checkServiceHealth

package/dist/system/index.js

@@ -1,37 +1,37 @@
 import {
   getCpuInfo
-} from "../chunk-GRGOD3W5.js";
+} from "../chunk-FD2TXDTO.js";
 import {
   getDiskInfo
-} from "../chunk-BY653UR3.js";
+} from "../chunk-6SOQUYOU.js";
 import {
   checkEnvironmentVariables
-} from "../chunk-2LCLLZME.js";
+} from "../chunk-WNF2RKFA.js";
 import {
   checkServiceHealth
-} from "../chunk-KAIGEZAL.js";
+} from "../chunk-BYCFXGQL.js";
 import "../chunk-OIVXOT2X.js";
 import {
   getMemoryInfo
-} from "../chunk-ZBU2DYLD.js";
+} from "../chunk-LFQ3IQQB.js";
 import {
   getNetworkInfo
-} from "../chunk-ZFFWKCHN.js";
+} from "../chunk-4HBAPPB2.js";
 import {
   getPlatform,
   getRecommendedCommands
-} from "../chunk-JGGGHEBC.js";
+} from "../chunk-S5UCZ2T3.js";
+import "../chunk-3CBGGMIY.js";
+import "../chunk-OZE5KUS3.js";
 import {
   logger
-} from "../chunk-SNNXLA5F.js";
-import "../chunk-V33BEN6H.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-JTPLPUI7.js";
-import "../chunk-5MBKG2ZD.js";
-import "../chunk-IQQKKUAV.js";
-import "../chunk-ITSXXSFN.js";
+} from "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
+import "../chunk-TFD3DSM2.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
+import "../chunk-IQQKKUAV.js";
 import "../chunk-ORMEWXMH.js";
 
 // src/system/index.ts

package/dist/system/memory.js

@@ -1,10 +1,10 @@
 import {
   getMemoryInfo
-} from "../chunk-ZBU2DYLD.js";
-import "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-LFQ3IQQB.js";
+import "../chunk-S5UCZ2T3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/system/network.js

@@ -1,10 +1,10 @@
 import {
   getNetworkInfo
-} from "../chunk-ZFFWKCHN.js";
-import "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-4HBAPPB2.js";
+import "../chunk-S5UCZ2T3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/system/utils.js

@@ -9,10 +9,10 @@ import {
   runMacCommand,
   runPlatformCommand,
   runSafeCommand
-} from "../chunk-JGGGHEBC.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-S5UCZ2T3.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/utils/cors.js

@@ -7,9 +7,9 @@ import {
   withCORS,
   withPublicCORS,
   withRestrictedCORS
-} from "../chunk-USL5SQLZ.js";
-import "../chunk-JNB7MWG4.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-TO5CMMQC.js";
+import "../chunk-GFWGLWTS.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/utils/csv-export.js

@@ -6,10 +6,10 @@ import {
   dateFormatter,
   escapeCsvField,
   rowToCsv
-} from "../chunk-FIRLRKET.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+} from "../chunk-K3HAYBWX.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
 import "../chunk-ORMEWXMH.js";

package/dist/utils/error-processor.js

@@ -12,14 +12,14 @@ import {
   throwUnauthorizedError,
   throwValidationError,
   withErrorHandling
-} from "../chunk-CZHFHEBG.js";
+} from "../chunk-E54MAI4I.js";
 import "../chunk-KXXROUA5.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+import "../chunk-SNVGJPPX.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
-import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {
   ErrorProcessor,

package/dist/utils/index.js

@@ -1,3 +1,11 @@
+import {
+  removeEventHandlers,
+  sanitizeArray,
+  sanitizeHtml,
+  sanitizeInput,
+  sanitizeObjectFields,
+  sanitizeUrl
+} from "../chunk-N54KGJPU.js";
 import {
   isApiErrorResponse,
   isApiSuccessResponse,
@@ -26,14 +34,6 @@ import {
   isValidJSON,
   isValidUrl
 } from "../chunk-EUQATJLI.js";
-import {
-  removeEventHandlers,
-  sanitizeArray,
-  sanitizeHtml,
-  sanitizeInput,
-  sanitizeObjectFields,
-  sanitizeUrl
-} from "../chunk-SR65BF6X.js";
 import {
   createPaginatedResponse,
   getReferer,
@@ -57,7 +57,7 @@ import {
   withCORS,
   withPublicCORS,
   withRestrictedCORS
-} from "../chunk-USL5SQLZ.js";
+} from "../chunk-TO5CMMQC.js";
 import {
   boolFormatter,
   createCsvHeader,
@@ -66,7 +66,7 @@ import {
   dateFormatter,
   escapeCsvField,
   rowToCsv
-} from "../chunk-FIRLRKET.js";
+} from "../chunk-K3HAYBWX.js";
 import {
   ErrorProcessor,
   errorToResponse,
@@ -80,15 +80,15 @@ import {
   throwUnauthorizedError,
   throwValidationError,
   withErrorHandling
-} from "../chunk-CZHFHEBG.js";
+} from "../chunk-E54MAI4I.js";
 import "../chunk-KXXROUA5.js";
-import "../chunk-SNNXLA5F.js";
-import "../chunk-JNB7MWG4.js";
-import "../chunk-RLXRDUBX.js";
-import "../chunk-5MBKG2ZD.js";
+import "../chunk-SNVGJPPX.js";
+import "../chunk-GFWGLWTS.js";
+import "../chunk-GQVBWZLH.js";
+import "../chunk-OHBAELPZ.js";
+import "../chunk-SFPMFVSD.js";
 import "../chunk-K25ICPU4.js";
 import "../chunk-2QH66EVQ.js";
-import "../chunk-SNVGJPPX.js";
 import "../chunk-ORMEWXMH.js";
 export {
   ErrorProcessor,

package/dist/utils/ip-utils.d.ts

@@ -4,12 +4,15 @@ export declare function normalizeIP(ip: string): string;
 /**
  * 클라이언트 IP 주소 추출 (서버에서만 사용)
  *
- * Cloudflare 환경 최적화:
- * 1. CF-Connecting-IP: Cloudflare가 설정하는 실제 클라이언트 IP (가장 신뢰)
- * 2. True-Client-IP: Cloudflare Enterprise에서 사용
- * 3. X-Real-IP: Nginx 등 신뢰할 수 있는 리버스 프록시
- * 4. X-Forwarded-For: 첫 번째 IP가 실제 클라이언트 (Cloudflare가 추가)
- * 5. X-Client-IP: 일부 프록시에서 사용
+ * 신뢰 가능한 프록시 헤더만 사용:
+ * 1. CF-Connecting-IP: Cloudflare Proxy가 강제 설정 (스푸핑 불가)
+ * 2. True-Client-IP: Cloudflare Enterprise에서 설정
+ * 3. X-Forwarded-For: 마지막 IP = 직전 프록시가 추가한 실제 클라이언트 IP
+ *
+ * 보안 참고:
+ * - X-Real-IP, X-Client-IP 등 클라이언트가 임의 설정 가능한 헤더는 사용하지 않음
+ * - X-Forwarded-For의 첫 번째 IP는 클라이언트가 조작 가능하므로 마지막 IP를 사용
+ * - Cloudflare Proxy 환경에서는 CF-Connecting-IP가 항상 설정되므로 폴백에 도달하지 않음
  */
 export declare function extractClientIp(headers: Headers): string | null;
 export declare function isValidIP(ip: string): boolean;

package/dist/utils/ip-utils.js

@@ -54,17 +54,14 @@ function extractClientIp(headers) {
   if (cf && isValidIP(cf.trim())) return cf.trim();
   const trueClientIp = headers.get("true-client-ip");
   if (trueClientIp && isValidIP(trueClientIp.trim())) return trueClientIp.trim();
-  const xri = headers.get("x-real-ip");
-  if (xri && isValidIP(xri.trim())) return xri.trim();
   const xff = headers.get("x-forwarded-for");
   if (xff) {
     const ips = xff.split(",").map((ip) => ip.trim()).filter(Boolean);
-    if (ips.length > 0 && isValidIP(ips[0])) {
-      return ips[0];
+    const lastIp = ips[ips.length - 1];
+    if (lastIp && isValidIP(lastIp)) {
+      return lastIp;
     }
   }
-  const xc = headers.get("x-client-ip");
-  if (xc && isValidIP(xc.trim())) return xc.trim();
   return null;
 }
 function isValidIP(ip) {

package/dist/utils/sanitizer.d.ts

@@ -8,15 +8,16 @@
  */
 /**
  * XSS 방지를 위한 HTML 태그 제거
- * - 모든 HTML 태그 제거
- * - 이스케이프된 HTML 엔티티 처리
+ * - 모든 HTML 태그 제거 (named + numeric 엔티티로 인코딩된 태그 포함)
+ * - 닫는 >가 없는 불완전 태그 제거 (HTML5 파서 우회 방지)
+ * - HTML 엔티티를 디코딩하여 원본 텍스트 반환
  * - 공백 정리
  *
  * @param input - 정제할 문자열
- * @returns 정제된 문자열
+ * @returns 태그가 제거된 순수 텍스트 (React 등 텍스트 컨텍스트에서 사용)
  *
  * @example
- * sanitizeHtml('<script>alert("xss")</script>Hello') // 'Hello'
+ * sanitizeHtml('<script>alert("xss")</script>Hello') // 'alert("xss")Hello'
  * sanitizeHtml('Hello <b>World</b>') // 'Hello World'
  */
 export declare function sanitizeHtml(input: string): string;

package/dist/utils/sanitizer.js

@@ -6,7 +6,7 @@ import {
   sanitizeObjectFields,
   sanitizeUrl,
   sanitizer_default
-} from "../chunk-SR65BF6X.js";
+} from "../chunk-N54KGJPU.js";
 import "../chunk-ORMEWXMH.js";
 export {
   sanitizer_default as default,

package/dist/utils/short-code-generator.d.ts

@@ -1,9 +1,10 @@
 /**
  * 단축 코드 생성 전용 유틸리티
- * 순수 함수로 구현하여 외부 의존성 없음
+ * 암호학적으로 안전한 난수 생성기(CSPRNG) 사용
  */
 /**
  * 기본 단축 코드 생성 함수
+ * crypto.randomBytes를 사용하여 예측 불가능한 코드 생성
  * @param length - 생성할 코드 길이 (기본값: 8)
  * @returns 생성된 단축 코드
  */

package/dist/utils/short-code-generator.js

@@ -1,14 +1,16 @@
 import "../chunk-ORMEWXMH.js";
 
 // src/utils/short-code-generator.ts
+import { randomBytes } from "crypto";
 function generateShortCode(length = 8) {
   if (!Number.isInteger(length) || length <= 0) {
     throw new Error("length must be a positive integer");
   }
   const chars = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  const bytes = randomBytes(length);
   let result = "";
   for (let i = 0; i < length; i++) {
-    result += chars.charAt(Math.floor(Math.random() * chars.length));
+    result += chars.charAt(bytes[i] % chars.length);
   }
   return result;
 }

package/dist/utils/url-normalizer.js

@@ -39,11 +39,21 @@ var SUPPORTED_SCHEMES = [
   "maps:",
   "geo:"
 ];
+var DANGEROUS_SCHEMES = [
+  "javascript:",
+  "vbscript:",
+  "data:",
+  "file:",
+  "blob:"
+];
 var CUSTOM_SCHEME_PATTERN = /^[a-zA-Z][a-zA-Z0-9+.-]*:/;
 function hasValidScheme(url) {
   try {
     const urlObj = new URL(url);
-    const protocol = urlObj.protocol;
+    const protocol = urlObj.protocol.toLowerCase();
+    if (DANGEROUS_SCHEMES.includes(protocol)) {
+      return false;
+    }
     if (SUPPORTED_SCHEMES.includes(protocol)) {
       return true;
     }
@@ -69,6 +79,9 @@ function normalizeUrl(url) {
   }
   const scheme = extractScheme(normalized);
   if (scheme) {
+    if (DANGEROUS_SCHEMES.includes(scheme.toLowerCase() + ":")) {
+      return "";
+    }
     return normalized;
   }
   if (normalized.startsWith("//")) {
@@ -88,6 +101,14 @@ function validateUrl(url, options) {
   try {
     const urlObj = new URL(normalized);
     const protocol = urlObj.protocol;
+    if (DANGEROUS_SCHEMES.includes(protocol.toLowerCase())) {
+      return {
+        isValid: false,
+        message: `\uBCF4\uC548\uC0C1 \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD504\uB85C\uD1A0\uCF5C\uC785\uB2C8\uB2E4: ${protocol}`,
+        messageKey: "unsupportedProtocol",
+        messageParams: { protocol }
+      };
+    }
     const isSupported = SUPPORTED_SCHEMES.includes(protocol);
     const isCustom = CUSTOM_SCHEME_PATTERN.test(normalized);
     if (!isSupported && !isCustom) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withwiz/toolkit",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "description": "Shared utility library for withwiz projects",
   "license": "MIT",
   "private": false,