shelving 1.232.0 → 1.233.0

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "shelving",
-	"version": "1.232.0",
+	"version": "1.233.0",
 	"author": "Dave Houlbrooke <dave@shax.com>",
 	"repository": {
 		"type": "git",

package/schema/EmailSchema.js

@@ -1,3 +1,4 @@
+import { sanitizeWord } from "../util/string.js";
 import { NULLABLE } from "./NullableSchema.js";
 import { StringSchema } from "./StringSchema.js";
 const R_MATCH = /^[a-z0-9](?:[a-zA-Z0-9._+-]{0,62}[a-zA-Z0-9])?@(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.){1,3}(?:[a-z]{2,63}|xn--[a-z0-9-]{0,58}[a-z0-9])$/;
@@ -32,7 +33,8 @@ export class EmailSchema extends StringSchema {
         });
     }
     sanitize(str) {
-        return super.sanitize(str).toLowerCase();
+        // Email addresses never contain whitespace, so strip it entirely, then lowercase (RFC says addresses should be case-insensitive).
+        return sanitizeWord(str).toLowerCase();
     }
 }
 /** Valid email, e.g. `test@test.com` */

package/schema/URISchema.d.ts

@@ -14,6 +14,7 @@ export declare class URISchema extends StringSchema {
     readonly schemes: URISchemes;
     constructor({ one, title, schemes, ...options }: URISchemaOptions);
     validate(unsafeValue: unknown): URIString;
+    sanitize(str: string): string;
     format(value: string): string;
 }
 /** Valid URI string, e.g. `https://www.google.com` */

package/schema/URISchema.js

@@ -1,4 +1,5 @@
 import { formatURI } from "../util/format.js";
+import { sanitizeWord } from "../util/string.js";
 import { getURI, HTTP_SCHEMES } from "../util/uri.js";
 import { NULLABLE } from "./NullableSchema.js";
 import { StringSchema } from "./StringSchema.js";
@@ -31,6 +32,10 @@ export class URISchema extends StringSchema {
             throw `Invalid ${this.one} scheme`;
         return uri.href;
     }
+    sanitize(str) {
+        // URIs never contain whitespace (a real space must be `%20`-encoded), so strip it entirely.
+        return sanitizeWord(str);
+    }
     format(value) {
         return formatURI(value, this.format);
     }

package/schema/URLSchema.d.ts

@@ -17,6 +17,7 @@ export declare class URLSchema extends StringSchema {
     readonly schemes: URISchemes;
     constructor({ one, title, base, schemes, ...options }: URLSchemaOptions);
     validate(unsafeValue: unknown): URLString;
+    sanitize(str: string): string;
     format(value: string): string;
 }
 /** Valid URL string, e.g. `https://www.google.com` */

package/schema/URLSchema.js

@@ -1,4 +1,5 @@
 import { formatURL } from "../util/format.js";
+import { sanitizeWord } from "../util/string.js";
 import { HTTP_SCHEMES } from "../util/uri.js";
 import { getURL } from "../util/url.js";
 import { NULLABLE } from "./NullableSchema.js";
@@ -34,6 +35,10 @@ export class URLSchema extends StringSchema {
             throw `Invalid ${this.one} scheme`;
         return url.href;
     }
+    sanitize(str) {
+        // URLs never contain whitespace (a real space must be `%20`-encoded), so strip it entirely.
+        return sanitizeWord(str);
+    }
     format(value) {
         return formatURL(value, this.base, this.format);
     }

package/util/string.d.ts

@@ -42,6 +42,15 @@ export declare function joinStrings(strs: Iterable<string> & NotString, joiner?:
  * @example santizeString("\x00Nice!   "); // Returns `"Nice!"`
  */
 export declare function sanitizeText(str: string): string;
+/**
+ * Sanitize a single word of text.
+ * - Used when you're sanitising a value that can never contain whitespace, e.g. an email address or token.
+ * - Remove all control characters (like `sanitizeText()`).
+ * - Strip all whitespace entirely (rather than collapsing runs to a single space like `sanitizeText()`).
+ *
+ * @example sanitizeWord("\x00 a b c "); // Returns `"abc"`
+ */
+export declare function sanitizeWord(str: string): string;
 /**
  * Sanitize multiple lines of text.
  * - Used when you're sanitising a multi-line input, e.g. a description for something.

package/util/string.js

@@ -69,6 +69,19 @@ export function sanitizeText(str) {
         .replace(/\s+/gu, " ") // Normalise runs of whitespace to one ` ` space.
         .trim(); // Trim whitespace from the start and end of the string.
 }
+/**
+ * Sanitize a single word of text.
+ * - Used when you're sanitising a value that can never contain whitespace, e.g. an email address or token.
+ * - Remove all control characters (like `sanitizeText()`).
+ * - Strip all whitespace entirely (rather than collapsing runs to a single space like `sanitizeText()`).
+ *
+ * @example sanitizeWord("\x00 a b c "); // Returns `"abc"`
+ */
+export function sanitizeWord(str) {
+    return str
+        .replace(/[^\P{C}\s]/gu, "") // Strip control characters (except whitespace).
+        .replace(/\s+/gu, ""); // Strip all whitespace entirely.
+}
 /**
  * Sanitize multiple lines of text.
  * - Used when you're sanitising a multi-line input, e.g. a description for something.