url-sanitizer 0.1.1

package/dist/url-sanitizer.js

@@ -0,0 +1,593 @@
+// src/mjs/common.js
+var TYPE_FROM = 8;
+var TYPE_TO = -1;
+var getType = (o) => Object.prototype.toString.call(o).slice(TYPE_FROM, TYPE_TO);
+var isString = (o) => typeof o === "string" || o instanceof String;
+
+// src/lib/iana/uri-schemes.json
+var uri_schemes_default = [
+  "aaa",
+  "aaas",
+  "about",
+  "acap",
+  "acct",
+  "acd",
+  "acr",
+  "adiumxtra",
+  "adt",
+  "afp",
+  "afs",
+  "aim",
+  "amss",
+  "android",
+  "appdata",
+  "apt",
+  "ar",
+  "ark",
+  "attachment",
+  "aw",
+  "barion",
+  "beshare",
+  "bitcoin",
+  "bitcoincash",
+  "blob",
+  "bolo",
+  "browserext",
+  "cabal",
+  "calculator",
+  "callto",
+  "cap",
+  "cast",
+  "casts",
+  "chrome",
+  "chrome-extension",
+  "cid",
+  "coap",
+  "coaps",
+  "com-eventbrite-attendee",
+  "content",
+  "content-type",
+  "crid",
+  "cstr",
+  "cvs",
+  "dab",
+  "dat",
+  "data",
+  "dav",
+  "diaspora",
+  "dict",
+  "did",
+  "dis",
+  "dlna-playcontainer",
+  "dlna-playsingle",
+  "dns",
+  "dntp",
+  "doi",
+  "dpp",
+  "drm",
+  "dtmi",
+  "dtn",
+  "dvb",
+  "dvx",
+  "dweb",
+  "ed2k",
+  "eid",
+  "elsi",
+  "embedded",
+  "ens",
+  "ethereum",
+  "example",
+  "facetime",
+  "feed",
+  "feedready",
+  "fido",
+  "file",
+  "finger",
+  "first-run-pen-experience",
+  "fish",
+  "fm",
+  "ftp",
+  "fuchsia-pkg",
+  "geo",
+  "gg",
+  "git",
+  "gitoid",
+  "gizmoproject",
+  "go",
+  "gopher",
+  "graph",
+  "gtalk",
+  "h323",
+  "ham",
+  "hcap",
+  "hcp",
+  "http",
+  "https",
+  "hxxp",
+  "hxxps",
+  "hydrazone",
+  "hyper",
+  "iax",
+  "icap",
+  "icon",
+  "im",
+  "imap",
+  "info",
+  "iotdisco",
+  "ipfs",
+  "ipn",
+  "ipns",
+  "ipp",
+  "ipps",
+  "irc",
+  "irc6",
+  "ircs",
+  "iris",
+  "iris.beep",
+  "iris.lwz",
+  "iris.xpc",
+  "iris.xpcs",
+  "isostore",
+  "itms",
+  "jabber",
+  "jar",
+  "jms",
+  "keyparc",
+  "lastfm",
+  "lbry",
+  "ldap",
+  "ldaps",
+  "leaptofrogans",
+  "lorawan",
+  "lpa",
+  "lvlt",
+  "magnet",
+  "mailto",
+  "maps",
+  "market",
+  "matrix",
+  "message",
+  "microsoft.windows.camera",
+  "microsoft.windows.camera.multipicker",
+  "microsoft.windows.camera.picker",
+  "mid",
+  "mms",
+  "mongodb",
+  "moz",
+  "moz-extension",
+  "ms-access",
+  "ms-appinstaller",
+  "ms-browser-extension",
+  "ms-calculator",
+  "ms-drive-to",
+  "ms-enrollment",
+  "ms-excel",
+  "ms-eyecontrolspeech",
+  "ms-gamebarservices",
+  "ms-gamingoverlay",
+  "ms-getoffice",
+  "ms-help",
+  "ms-infopath",
+  "ms-inputapp",
+  "ms-lockscreencomponent-config",
+  "ms-media-stream-id",
+  "ms-meetnow",
+  "ms-mixedrealitycapture",
+  "ms-mobileplans",
+  "ms-newsandinterests",
+  "ms-officeapp",
+  "ms-people",
+  "ms-powerpoint",
+  "ms-project",
+  "ms-publisher",
+  "ms-remotedesktop-launch",
+  "ms-restoretabcompanion",
+  "ms-screenclip",
+  "ms-screensketch",
+  "ms-search",
+  "ms-search-repair",
+  "ms-secondary-screen-controller",
+  "ms-secondary-screen-setup",
+  "ms-settings",
+  "ms-settings-airplanemode",
+  "ms-settings-bluetooth",
+  "ms-settings-camera",
+  "ms-settings-cellular",
+  "ms-settings-cloudstorage",
+  "ms-settings-connectabledevices",
+  "ms-settings-displays-topology",
+  "ms-settings-emailandaccounts",
+  "ms-settings-language",
+  "ms-settings-location",
+  "ms-settings-lock",
+  "ms-settings-nfctransactions",
+  "ms-settings-notifications",
+  "ms-settings-power",
+  "ms-settings-privacy",
+  "ms-settings-proximity",
+  "ms-settings-screenrotation",
+  "ms-settings-wifi",
+  "ms-settings-workplace",
+  "ms-spd",
+  "ms-stickers",
+  "ms-sttoverlay",
+  "ms-transit-to",
+  "ms-useractivityset",
+  "ms-virtualtouchpad",
+  "ms-visio",
+  "ms-walk-to",
+  "ms-whiteboard",
+  "ms-whiteboard-cmd",
+  "ms-word",
+  "msnim",
+  "msrp",
+  "msrps",
+  "mss",
+  "mt",
+  "mtqp",
+  "mumble",
+  "mupdate",
+  "mvn",
+  "news",
+  "nfs",
+  "ni",
+  "nih",
+  "nntp",
+  "notes",
+  "num",
+  "ocf",
+  "oid",
+  "onenote",
+  "onenote-cmd",
+  "opaquelocktoken",
+  "openpgp4fpr",
+  "otpauth",
+  "palm",
+  "paparazzi",
+  "payment",
+  "payto",
+  "pkcs11",
+  "platform",
+  "pop",
+  "pres",
+  "proxy",
+  "psyc",
+  "pttp",
+  "pwid",
+  "qb",
+  "query",
+  "quic-transport",
+  "redis",
+  "rediss",
+  "reload",
+  "res",
+  "resource",
+  "rmi",
+  "rsync",
+  "rtmfp",
+  "rtmp",
+  "rtsp",
+  "rtsps",
+  "rtspu",
+  "sarif",
+  "secondlife",
+  "secret-token",
+  "service",
+  "session",
+  "sftp",
+  "sgn",
+  "shc",
+  "sieve",
+  "simpleledger",
+  "simplex",
+  "sip",
+  "sips",
+  "skype",
+  "smb",
+  "smp",
+  "sms",
+  "smtp",
+  "snmp",
+  "soap.beep",
+  "soap.beeps",
+  "soldat",
+  "spiffe",
+  "spotify",
+  "ssb",
+  "ssh",
+  "starknet",
+  "steam",
+  "stun",
+  "stuns",
+  "submit",
+  "svn",
+  "swh",
+  "swid",
+  "swidpath",
+  "tag",
+  "taler",
+  "teamspeak",
+  "tel",
+  "teliaeid",
+  "telnet",
+  "tftp",
+  "things",
+  "thismessage",
+  "tip",
+  "tn3270",
+  "tool",
+  "turn",
+  "turns",
+  "tv",
+  "udp",
+  "unreal",
+  "urn",
+  "ut2004",
+  "uuid-in-package",
+  "v-event",
+  "vemmi",
+  "ventrilo",
+  "ves",
+  "view-source",
+  "vnc",
+  "vscode",
+  "vscode-insiders",
+  "vsls",
+  "w3",
+  "wcr",
+  "web3",
+  "webcal",
+  "wifi",
+  "ws",
+  "wss",
+  "wtai",
+  "wyciwyg",
+  "xcon",
+  "xcon-userid",
+  "xfire",
+  "xmlrpc.beep",
+  "xmlrpc.beeps",
+  "xmpp",
+  "xri",
+  "ymsgr",
+  "z39.50r",
+  "z39.50s"
+];
+
+// src/mjs/uri-util.js
+var HEX = 16;
+var getUrlEncodedString = (str) => {
+  if (!isString(str)) {
+    throw new TypeError(`Expected String but got ${getType(str)}.`);
+  }
+  const chars = [];
+  for (const ch of str) {
+    chars.push(`%${ch.charCodeAt(0).toString(HEX).toUpperCase()}`);
+  }
+  return chars.join("");
+};
+var escapeUrlEncodedHtmlChars = (ch) => {
+  if (isString(ch)) {
+    if (/^%[\dA-F]{2}$/i.test(ch)) {
+      ch = ch.toUpperCase();
+    } else {
+      throw new Error(`${ch} is not a URL encoded character.`);
+    }
+  } else {
+    throw new TypeError(`Expected String but got ${getType(ch)}.`);
+  }
+  const [amp, num, lt, gt, quot, apos] = ["&", "#", "<", ">", '"', "'"].map(getUrlEncodedString);
+  let escapedChar;
+  if (ch === amp) {
+    escapedChar = `${amp}amp;`;
+  } else if (ch === lt) {
+    escapedChar = `${amp}lt;`;
+  } else if (ch === gt) {
+    escapedChar = `${amp}gt;`;
+  } else if (ch === quot) {
+    escapedChar = `${amp}quot;`;
+  } else if (ch === apos) {
+    escapedChar = `${amp}${num}39;`;
+  } else {
+    escapedChar = ch;
+  }
+  return escapedChar;
+};
+var parseBase64 = (data) => {
+  if (!isString(data)) {
+    throw new TypeError(`Expected String but got ${getType(data)}.`);
+  }
+  const bin = atob(data);
+  const uint8arr = Uint8Array.from([...bin].map((c) => c.charCodeAt(0)));
+  const textChars = /* @__PURE__ */ new Set([7, 8, 9, 10, 11, 12, 13, 27]);
+  for (let i = 32; i < 127; i++) {
+    textChars.add(i);
+  }
+  for (let i = 128; i <= 255; i++) {
+    textChars.add(i);
+  }
+  let parsedData;
+  if (uint8arr.every((c) => textChars.has(c))) {
+    parsedData = bin;
+  } else {
+    parsedData = data;
+  }
+  return parsedData;
+};
+var URISchemes = class {
+  /* private fields */
+  #schemes;
+  /**
+   * construct
+   */
+  constructor() {
+    this.#schemes = new Set(uri_schemes_default);
+  }
+  /**
+   * get schemes
+   *
+   * @see {@link https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml}
+   *      - Historical schemes omitted
+   *      - Added 'moz-extension' scheme by default
+   * @returns {Array.<string>} - array of schemes
+   */
+  get() {
+    return [...this.#schemes];
+  }
+  /**
+   * has scheme
+   *
+   * @param {string} scheme - scheme
+   * @returns {boolean} - result
+   */
+  has(scheme) {
+    return this.#schemes.has(scheme);
+  }
+  /**
+   * add scheme
+   * NOTE: `javascript` and/or `vbscript` schemes can not be registered
+   *
+   * @param {string} scheme - scheme
+   * @returns {Array.<string>} - array of schemes
+   */
+  add(scheme) {
+    if (!isString(scheme)) {
+      throw new TypeError(`Expected String but got ${getType(scheme)}.`);
+    } else if (/(?:java|vb)script/.test(scheme) || !/^[a-z][a-z0-9+\-.]*$/.test(scheme)) {
+      throw new Error(`Invalid scheme: ${scheme}`);
+    }
+    this.#schemes.add(scheme);
+    return [...this.#schemes];
+  }
+  /**
+   * remove scheme
+   *
+   * @param {string} scheme - scheme
+   * @returns {boolean} - result
+   */
+  remove(scheme) {
+    return this.#schemes.delete(scheme);
+  }
+  /**
+   * is URI
+   *
+   * @param {string} uri - URI input
+   * @returns {boolean} - result
+   */
+  isURI(uri) {
+    let res;
+    if (isString(uri)) {
+      try {
+        const { protocol } = new URL(uri);
+        const scheme = protocol.replace(/:$/, "");
+        const schemeParts = scheme.split("+");
+        res = /^(?:ext|web)\+[a-z]+$/.test(scheme) || schemeParts.every((s) => this.#schemes.has(s));
+      } catch (e) {
+        res = false;
+      }
+    }
+    return !!res;
+  }
+};
+var URLSanitizer = class extends URISchemes {
+  /**
+   * sanitize URL
+   * NOTE: `data` and/or `file` schemes must be explicitly allowed
+   *       `javascript` and/or `vbscript` schemes can not be allowed
+   *
+   * @param {string} url - URL input
+   * @param {object} opt - options
+   * @param {Array.<string>} opt.allow - array of allowed schemes
+   * @param {Array.<string>} opt.deny - array of denied schemes
+   * @param {boolean} opt.escapeTags - escape tags and quotes in data URL
+   * @returns {?string} - sanitized URL
+   */
+  sanitize(url, opt = { allow: [], deny: [], escapeTags: true }) {
+    let sanitizedUrl;
+    if (super.isURI(url)) {
+      const { allow, deny, escapeTags } = opt ?? {};
+      const { href, pathname, protocol } = new URL(url);
+      const scheme = protocol.replace(/:$/, "");
+      const schemeParts = scheme.split("+");
+      const schemeMap = /* @__PURE__ */ new Map([["data", false], ["file", false]]);
+      if (Array.isArray(allow) && allow.length) {
+        const items = Object.values(allow);
+        for (let item of items) {
+          if (isString(item)) {
+            item = item.trim();
+            if (/(?:java|vb)script/.test(item)) {
+              schemeMap.set(item, false);
+            } else if (item) {
+              schemeMap.set(item, true);
+            }
+          }
+        }
+      }
+      if (Array.isArray(deny) && deny.length) {
+        const items = Object.values(deny);
+        for (let item of items) {
+          if (isString(item)) {
+            item = item.trim();
+            if (item) {
+              schemeMap.set(item, false);
+            }
+          }
+        }
+      }
+      let bool;
+      for (const [key, value] of schemeMap.entries()) {
+        bool = value || scheme !== key && schemeParts.every((s) => s !== key);
+        if (!bool) {
+          break;
+        }
+      }
+      if (bool) {
+        let urlToSanitize = href;
+        if (schemeParts.includes("data")) {
+          const [header, data] = pathname.split(",");
+          const mediaType = header.split(";");
+          const isBase64 = mediaType.pop() === "base64";
+          if (isBase64) {
+            const parsedData = parseBase64(data);
+            if (parsedData !== data) {
+              urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
+            }
+          }
+        }
+        const [amp, lt, gt, quot, apos] = ["&", "<", ">", '"', "'"].map(getUrlEncodedString);
+        const regChars = /[<>"']/g;
+        const regAmp = new RegExp(amp, "g");
+        const regEncodedChars = new RegExp(`(${lt}|${gt}|${quot}|${apos})`, "g");
+        if (schemeParts.includes("data") && !(escapeTags ?? true)) {
+          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString).replace(regAmp, escapeUrlEncodedHtmlChars);
+        } else {
+          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString).replace(regAmp, escapeUrlEncodedHtmlChars).replace(regEncodedChars, escapeUrlEncodedHtmlChars);
+        }
+      }
+    }
+    return sanitizedUrl || null;
+  }
+};
+var urlSanitizer = new URLSanitizer();
+var isUri = (uri) => urlSanitizer.isURI(uri);
+var isURI = async (uri) => {
+  const res = await isUri(uri);
+  return res;
+};
+var sanitizeUrl = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
+  allow: [],
+  deny: [],
+  escapeTags: true
+});
+var sanitizeURL = async (url, opt) => {
+  const res = await sanitizeUrl(url, opt);
+  return res;
+};
+export {
+  urlSanitizer as default,
+  isURI,
+  isUri as isURISync,
+  sanitizeURL,
+  sanitizeUrl as sanitizeURLSync
+};
+//# sourceMappingURL=url-sanitizer.js.map

package/dist/url-sanitizer.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/mjs/common.js", "../src/lib/iana/uri-schemes.json", "../src/mjs/uri-util.js"],
+  "sourcesContent": ["/**\n * common.js\n */\n\n/* constants */\nconst TYPE_FROM = 8;\nconst TYPE_TO = -1;\n\n/**\n * get type\n *\n * @param {*} o - object to check\n * @returns {string} - type of object\n */\nexport const getType = o =>\n  Object.prototype.toString.call(o).slice(TYPE_FROM, TYPE_TO);\n\n/**\n * is string\n *\n * @param {*} o - object to check\n * @returns {boolean} - result\n */\nexport const isString = o => typeof o === 'string' || o instanceof String;\n", "[\n  \"aaa\",\n  \"aaas\",\n  \"about\",\n  \"acap\",\n  \"acct\",\n  \"acd\",\n  \"acr\",\n  \"adiumxtra\",\n  \"adt\",\n  \"afp\",\n  \"afs\",\n  \"aim\",\n  \"amss\",\n  \"android\",\n  \"appdata\",\n  \"apt\",\n  \"ar\",\n  \"ark\",\n  \"attachment\",\n  \"aw\",\n  \"barion\",\n  \"beshare\",\n  \"bitcoin\",\n  \"bitcoincash\",\n  \"blob\",\n  \"bolo\",\n  \"browserext\",\n  \"cabal\",\n  \"calculator\",\n  \"callto\",\n  \"cap\",\n  \"cast\",\n  \"casts\",\n  \"chrome\",\n  \"chrome-extension\",\n  \"cid\",\n  \"coap\",\n  \"coaps\",\n  \"com-eventbrite-attendee\",\n  \"content\",\n  \"content-type\",\n  \"crid\",\n  \"cstr\",\n  \"cvs\",\n  \"dab\",\n  \"dat\",\n  \"data\",\n  \"dav\",\n  \"diaspora\",\n  \"dict\",\n  \"did\",\n  \"dis\",\n  \"dlna-playcontainer\",\n  \"dlna-playsingle\",\n  \"dns\",\n  \"dntp\",\n  \"doi\",\n  \"dpp\",\n  \"drm\",\n  \"dtmi\",\n  \"dtn\",\n  \"dvb\",\n  \"dvx\",\n  \"dweb\",\n  \"ed2k\",\n  \"eid\",\n  \"elsi\",\n  \"embedded\",\n  \"ens\",\n  \"ethereum\",\n  \"example\",\n  \"facetime\",\n  \"feed\",\n  \"feedready\",\n  \"fido\",\n  \"file\",\n  \"finger\",\n  \"first-run-pen-experience\",\n  \"fish\",\n  \"fm\",\n  \"ftp\",\n  \"fuchsia-pkg\",\n  \"geo\",\n  \"gg\",\n  \"git\",\n  \"gitoid\",\n  \"gizmoproject\",\n  \"go\",\n  \"gopher\",\n  \"graph\",\n  \"gtalk\",\n  \"h323\",\n  \"ham\",\n  \"hcap\",\n  \"hcp\",\n  \"http\",\n  \"https\",\n  \"hxxp\",\n  \"hxxps\",\n  \"hydrazone\",\n  \"hyper\",\n  \"iax\",\n  \"icap\",\n  \"icon\",\n  \"im\",\n  \"imap\",\n  \"info\",\n  \"iotdisco\",\n  \"ipfs\",\n  \"ipn\",\n  \"ipns\",\n  \"ipp\",\n  \"ipps\",\n  \"irc\",\n  \"irc6\",\n  \"ircs\",\n  \"iris\",\n  \"iris.beep\",\n  \"iris.lwz\",\n  \"iris.xpc\",\n  \"iris.xpcs\",\n  \"isostore\",\n  \"itms\",\n  \"jabber\",\n  \"jar\",\n  \"jms\",\n  \"keyparc\",\n  \"lastfm\",\n  \"lbry\",\n  \"ldap\",\n  \"ldaps\",\n  \"leaptofrogans\",\n  \"lorawan\",\n  \"lpa\",\n  \"lvlt\",\n  \"magnet\",\n  \"mailto\",\n  \"maps\",\n  \"market\",\n  \"matrix\",\n  \"message\",\n  \"microsoft.windows.camera\",\n  \"microsoft.windows.camera.multipicker\",\n  \"microsoft.windows.camera.picker\",\n  \"mid\",\n  \"mms\",\n  \"mongodb\",\n  \"moz\",\n  \"moz-extension\",\n  \"ms-access\",\n  \"ms-appinstaller\",\n  \"ms-browser-extension\",\n  \"ms-calculator\",\n  \"ms-drive-to\",\n  \"ms-enrollment\",\n  \"ms-excel\",\n  \"ms-eyecontrolspeech\",\n  \"ms-gamebarservices\",\n  \"ms-gamingoverlay\",\n  \"ms-getoffice\",\n  \"ms-help\",\n  \"ms-infopath\",\n  \"ms-inputapp\",\n  \"ms-lockscreencomponent-config\",\n  \"ms-media-stream-id\",\n  \"ms-meetnow\",\n  \"ms-mixedrealitycapture\",\n  \"ms-mobileplans\",\n  \"ms-newsandinterests\",\n  \"ms-officeapp\",\n  \"ms-people\",\n  \"ms-powerpoint\",\n  \"ms-project\",\n  \"ms-publisher\",\n  \"ms-remotedesktop-launch\",\n  \"ms-restoretabcompanion\",\n  \"ms-screenclip\",\n  \"ms-screensketch\",\n  \"ms-search\",\n  \"ms-search-repair\",\n  \"ms-secondary-screen-controller\",\n  \"ms-secondary-screen-setup\",\n  \"ms-settings\",\n  \"ms-settings-airplanemode\",\n  \"ms-settings-bluetooth\",\n  \"ms-settings-camera\",\n  \"ms-settings-cellular\",\n  \"ms-settings-cloudstorage\",\n  \"ms-settings-connectabledevices\",\n  \"ms-settings-displays-topology\",\n  \"ms-settings-emailandaccounts\",\n  \"ms-settings-language\",\n  \"ms-settings-location\",\n  \"ms-settings-lock\",\n  \"ms-settings-nfctransactions\",\n  \"ms-settings-notifications\",\n  \"ms-settings-power\",\n  \"ms-settings-privacy\",\n  \"ms-settings-proximity\",\n  \"ms-settings-screenrotation\",\n  \"ms-settings-wifi\",\n  \"ms-settings-workplace\",\n  \"ms-spd\",\n  \"ms-stickers\",\n  \"ms-sttoverlay\",\n  \"ms-transit-to\",\n  \"ms-useractivityset\",\n  \"ms-virtualtouchpad\",\n  \"ms-visio\",\n  \"ms-walk-to\",\n  \"ms-whiteboard\",\n  \"ms-whiteboard-cmd\",\n  \"ms-word\",\n  \"msnim\",\n  \"msrp\",\n  \"msrps\",\n  \"mss\",\n  \"mt\",\n  \"mtqp\",\n  \"mumble\",\n  \"mupdate\",\n  \"mvn\",\n  \"news\",\n  \"nfs\",\n  \"ni\",\n  \"nih\",\n  \"nntp\",\n  \"notes\",\n  \"num\",\n  \"ocf\",\n  \"oid\",\n  \"onenote\",\n  \"onenote-cmd\",\n  \"opaquelocktoken\",\n  \"openpgp4fpr\",\n  \"otpauth\",\n  \"palm\",\n  \"paparazzi\",\n  \"payment\",\n  \"payto\",\n  \"pkcs11\",\n  \"platform\",\n  \"pop\",\n  \"pres\",\n  \"proxy\",\n  \"psyc\",\n  \"pttp\",\n  \"pwid\",\n  \"qb\",\n  \"query\",\n  \"quic-transport\",\n  \"redis\",\n  \"rediss\",\n  \"reload\",\n  \"res\",\n  \"resource\",\n  \"rmi\",\n  \"rsync\",\n  \"rtmfp\",\n  \"rtmp\",\n  \"rtsp\",\n  \"rtsps\",\n  \"rtspu\",\n  \"sarif\",\n  \"secondlife\",\n  \"secret-token\",\n  \"service\",\n  \"session\",\n  \"sftp\",\n  \"sgn\",\n  \"shc\",\n  \"sieve\",\n  \"simpleledger\",\n  \"simplex\",\n  \"sip\",\n  \"sips\",\n  \"skype\",\n  \"smb\",\n  \"smp\",\n  \"sms\",\n  \"smtp\",\n  \"snmp\",\n  \"soap.beep\",\n  \"soap.beeps\",\n  \"soldat\",\n  \"spiffe\",\n  \"spotify\",\n  \"ssb\",\n  \"ssh\",\n  \"starknet\",\n  \"steam\",\n  \"stun\",\n  \"stuns\",\n  \"submit\",\n  \"svn\",\n  \"swh\",\n  \"swid\",\n  \"swidpath\",\n  \"tag\",\n  \"taler\",\n  \"teamspeak\",\n  \"tel\",\n  \"teliaeid\",\n  \"telnet\",\n  \"tftp\",\n  \"things\",\n  \"thismessage\",\n  \"tip\",\n  \"tn3270\",\n  \"tool\",\n  \"turn\",\n  \"turns\",\n  \"tv\",\n  \"udp\",\n  \"unreal\",\n  \"urn\",\n  \"ut2004\",\n  \"uuid-in-package\",\n  \"v-event\",\n  \"vemmi\",\n  \"ventrilo\",\n  \"ves\",\n  \"view-source\",\n  \"vnc\",\n  \"vscode\",\n  \"vscode-insiders\",\n  \"vsls\",\n  \"w3\",\n  \"wcr\",\n  \"web3\",\n  \"webcal\",\n  \"wifi\",\n  \"ws\",\n  \"wss\",\n  \"wtai\",\n  \"wyciwyg\",\n  \"xcon\",\n  \"xcon-userid\",\n  \"xfire\",\n  \"xmlrpc.beep\",\n  \"xmlrpc.beeps\",\n  \"xmpp\",\n  \"xri\",\n  \"ymsgr\",\n  \"z39.50r\",\n  \"z39.50s\"\n]\n", "/**\n * uri-util.js\n */\n\n/* shared */\nimport { getType, isString } from './common.js';\nimport uriSchemes from '../lib/iana/uri-schemes.json' assert { type: 'json' };\n\n/* constants */\nconst HEX = 16;\n\n/**\n * get URL encoded string\n *\n * @param {string} str - string\n * @returns {string} - URL encoded string\n */\nexport const getUrlEncodedString = str => {\n  if (!isString(str)) {\n    throw new TypeError(`Expected String but got ${getType(str)}.`);\n  }\n  const chars = [];\n  for (const ch of str) {\n    chars.push(`%${ch.charCodeAt(0).toString(HEX).toUpperCase()}`);\n  }\n  return chars.join('');\n};\n\n/**\n * escape URL encoded HTML special chars\n *\n * @param {string} ch - URL encoded (percent encoded) char\n * @returns {string} - escaped URL encoded HTML special char / URL encoded char\n */\nexport const escapeUrlEncodedHtmlChars = ch => {\n  if (isString(ch)) {\n    if (/^%[\\dA-F]{2}$/i.test(ch)) {\n      ch = ch.toUpperCase();\n    } else {\n      throw new Error(`${ch} is not a URL encoded character.`);\n    }\n  } else {\n    throw new TypeError(`Expected String but got ${getType(ch)}.`);\n  }\n  const [amp, num, lt, gt, quot, apos] =\n    ['&', '#', '<', '>', '\"', \"'\"].map(getUrlEncodedString);\n  let escapedChar;\n  if (ch === amp) {\n    escapedChar = `${amp}amp;`;\n  } else if (ch === lt) {\n    escapedChar = `${amp}lt;`;\n  } else if (ch === gt) {\n    escapedChar = `${amp}gt;`;\n  } else if (ch === quot) {\n    escapedChar = `${amp}quot;`;\n  } else if (ch === apos) {\n    escapedChar = `${amp}${num}39;`;\n  } else {\n    escapedChar = ch;\n  }\n  return escapedChar;\n};\n\n/**\n * parse base64\n *\n * @see {@link https://github.com/file/file/blob/master/src/encoding.c}\n * @param {string} data - base64 data\n * @returns {string} - parsed data / base64 data\n */\nexport const parseBase64 = data => {\n  if (!isString(data)) {\n    throw new TypeError(`Expected String but got ${getType(data)}.`);\n  }\n  const bin = atob(data);\n  const uint8arr = Uint8Array.from([...bin].map(c => c.charCodeAt(0)));\n  const textChars = new Set([0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x1b]);\n  for (let i = 0x20; i < 0x7f; i++) {\n    textChars.add(i);\n  }\n  for (let i = 0x80; i <= 0xff; i++) {\n    textChars.add(i);\n  }\n  let parsedData;\n  if (uint8arr.every(c => textChars.has(c))) {\n    parsedData = bin;\n  } else {\n    parsedData = data;\n  }\n  return parsedData;\n};\n\n/**\n * URI schemes\n *\n */\nexport class URISchemes {\n  /* private fields */\n  #schemes;\n\n  /**\n   * construct\n   */\n  constructor() {\n    this.#schemes = new Set(uriSchemes);\n  }\n\n  /**\n   * get schemes\n   *\n   * @see {@link https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml}\n   *      - Historical schemes omitted\n   *      - Added 'moz-extension' scheme by default\n   * @returns {Array.<string>} - array of schemes\n   */\n  get() {\n    return [...this.#schemes];\n  }\n\n  /**\n   * has scheme\n   *\n   * @param {string} scheme - scheme\n   * @returns {boolean} - result\n   */\n  has(scheme) {\n    return this.#schemes.has(scheme);\n  }\n\n  /**\n   * add scheme\n   * NOTE: `javascript` and/or `vbscript` schemes can not be registered\n   *\n   * @param {string} scheme - scheme\n   * @returns {Array.<string>} - array of schemes\n   */\n  add(scheme) {\n    if (!isString(scheme)) {\n      throw new TypeError(`Expected String but got ${getType(scheme)}.`);\n    } else if (/(?:java|vb)script/.test(scheme) ||\n               !/^[a-z][a-z0-9+\\-.]*$/.test(scheme)) {\n      throw new Error(`Invalid scheme: ${scheme}`);\n    }\n    this.#schemes.add(scheme);\n    return [...this.#schemes];\n  }\n\n  /**\n   * remove scheme\n   *\n   * @param {string} scheme - scheme\n   * @returns {boolean} - result\n   */\n  remove(scheme) {\n    return this.#schemes.delete(scheme);\n  }\n\n  /**\n   * is URI\n   *\n   * @param {string} uri - URI input\n   * @returns {boolean} - result\n   */\n  isURI(uri) {\n    let res;\n    if (isString(uri)) {\n      try {\n        const { protocol } = new URL(uri);\n        const scheme = protocol.replace(/:$/, '');\n        const schemeParts = scheme.split('+');\n        res = /^(?:ext|web)\\+[a-z]+$/.test(scheme) ||\n              schemeParts.every(s => this.#schemes.has(s));\n      } catch (e) {\n        res = false;\n      }\n    }\n    return !!res;\n  }\n}\n\n/* URL sanitizer */\nexport class URLSanitizer extends URISchemes {\n  /**\n   * sanitize URL\n   * NOTE: `data` and/or `file` schemes must be explicitly allowed\n   *       `javascript` and/or `vbscript` schemes can not be allowed\n   *\n   * @param {string} url - URL input\n   * @param {object} opt - options\n   * @param {Array.<string>} opt.allow - array of allowed schemes\n   * @param {Array.<string>} opt.deny - array of denied schemes\n   * @param {boolean} opt.escapeTags - escape tags and quotes in data URL\n   * @returns {?string} - sanitized URL\n   */\n  sanitize(url, opt = { allow: [], deny: [], escapeTags: true }) {\n    let sanitizedUrl;\n    if (super.isURI(url)) {\n      const { allow, deny, escapeTags } = opt ?? {};\n      const { href, pathname, protocol } = new URL(url);\n      const scheme = protocol.replace(/:$/, '');\n      const schemeParts = scheme.split('+');\n      const schemeMap = new Map([['data', false], ['file', false]]);\n      if (Array.isArray(allow) && allow.length) {\n        const items = Object.values(allow);\n        for (let item of items) {\n          if (isString(item)) {\n            item = item.trim();\n            if (/(?:java|vb)script/.test(item)) {\n              schemeMap.set(item, false);\n            } else if (item) {\n              schemeMap.set(item, true);\n            }\n          }\n        }\n      }\n      if (Array.isArray(deny) && deny.length) {\n        const items = Object.values(deny);\n        for (let item of items) {\n          if (isString(item)) {\n            item = item.trim();\n            if (item) {\n              schemeMap.set(item, false);\n            }\n          }\n        }\n      }\n      let bool;\n      for (const [key, value] of schemeMap.entries()) {\n        bool = value || (scheme !== key && schemeParts.every(s => s !== key));\n        if (!bool) {\n          break;\n        }\n      }\n      if (bool) {\n        let urlToSanitize = href;\n        if (schemeParts.includes('data')) {\n          const [header, data] = pathname.split(',');\n          const mediaType = header.split(';');\n          const isBase64 = mediaType.pop() === 'base64';\n          if (isBase64) {\n            const parsedData = parseBase64(data);\n            if (parsedData !== data) {\n              urlToSanitize = `${scheme}:${mediaType.join(';')},${parsedData}`;\n            }\n          }\n        }\n        const [amp, lt, gt, quot, apos] =\n          ['&', '<', '>', '\"', \"'\"].map(getUrlEncodedString);\n        const regChars = /[<>\"']/g;\n        const regAmp = new RegExp(amp, 'g');\n        const regEncodedChars =\n          new RegExp(`(${lt}|${gt}|${quot}|${apos})`, 'g');\n        if (schemeParts.includes('data') && !(escapeTags ?? true)) {\n          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString)\n            .replace(regAmp, escapeUrlEncodedHtmlChars);\n        } else {\n          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString)\n            .replace(regAmp, escapeUrlEncodedHtmlChars)\n            .replace(regEncodedChars, escapeUrlEncodedHtmlChars);\n        }\n      }\n    }\n    return sanitizedUrl || null;\n  }\n}\n\nconst urlSanitizer = new URLSanitizer();\n\n/* alias */\n/**\n * is URI sync\n *\n * @param {string} uri - URI input\n * @returns {boolean} - result\n */\nconst isUri = uri => urlSanitizer.isURI(uri);\n\n/**\n * is URI async\n *\n * @param {string} uri - URI input\n * @returns {boolean} - result\n */\nexport const isURI = async uri => {\n  const res = await isUri(uri);\n  return res;\n};\n\n/**\n * sanitize URL sync\n *\n * @param {string} url - URL input\n * @param {object} opt - options\n * @returns {?string} - sanitized URL\n */\nconst sanitizeUrl = (url, opt) => urlSanitizer.sanitize(url, opt ?? {\n  allow: [],\n  deny: [],\n  escapeTags: true\n});\n\n/**\n * sanitize URL async\n *\n * @param {string} url - URL input\n * @param {object} opt - options\n * @returns {?string} - sanitized URL\n */\nexport const sanitizeURL = async (url, opt) => {\n  const res = await sanitizeUrl(url, opt);\n  return res;\n};\n\nexport {\n  urlSanitizer as default,\n  isUri as isURISync,\n  sanitizeUrl as sanitizeURLSync\n};\n"],
+  "mappings": ";AAKA,IAAM,YAAY;AAClB,IAAM,UAAU;AAQT,IAAM,UAAU,OACrB,OAAO,UAAU,SAAS,KAAK,CAAC,EAAE,MAAM,WAAW,OAAO;AAQrD,IAAM,WAAW,OAAK,OAAO,MAAM,YAAY,aAAa;;;ACvBnE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;AClVA,IAAM,MAAM;AAQL,IAAM,sBAAsB,SAAO;AACxC,MAAI,CAAC,SAAS,GAAG,GAAG;AAClB,UAAM,IAAI,UAAU,2BAA2B,QAAQ,GAAG,IAAI;AAAA,EAChE;AACA,QAAM,QAAQ,CAAC;AACf,aAAW,MAAM,KAAK;AACpB,UAAM,KAAK,IAAI,GAAG,WAAW,CAAC,EAAE,SAAS,GAAG,EAAE,YAAY,GAAG;AAAA,EAC/D;AACA,SAAO,MAAM,KAAK,EAAE;AACtB;AAQO,IAAM,4BAA4B,QAAM;AAC7C,MAAI,SAAS,EAAE,GAAG;AAChB,QAAI,iBAAiB,KAAK,EAAE,GAAG;AAC7B,WAAK,GAAG,YAAY;AAAA,IACtB,OAAO;AACL,YAAM,IAAI,MAAM,GAAG,oCAAoC;AAAA,IACzD;AAAA,EACF,OAAO;AACL,UAAM,IAAI,UAAU,2BAA2B,QAAQ,EAAE,IAAI;AAAA,EAC/D;AACA,QAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,IAAI,IACjC,CAAC,KAAK,KAAK,KAAK,KAAK,KAAK,GAAG,EAAE,IAAI,mBAAmB;AACxD,MAAI;AACJ,MAAI,OAAO,KAAK;AACd,kBAAc,GAAG;AAAA,EACnB,WAAW,OAAO,IAAI;AACpB,kBAAc,GAAG;AAAA,EACnB,WAAW,OAAO,IAAI;AACpB,kBAAc,GAAG;AAAA,EACnB,WAAW,OAAO,MAAM;AACtB,kBAAc,GAAG;AAAA,EACnB,WAAW,OAAO,MAAM;AACtB,kBAAc,GAAG,MAAM;AAAA,EACzB,OAAO;AACL,kBAAc;AAAA,EAChB;AACA,SAAO;AACT;AASO,IAAM,cAAc,UAAQ;AACjC,MAAI,CAAC,SAAS,IAAI,GAAG;AACnB,UAAM,IAAI,UAAU,2BAA2B,QAAQ,IAAI,IAAI;AAAA,EACjE;AACA,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,WAAW,WAAW,KAAK,CAAC,GAAG,GAAG,EAAE,IAAI,OAAK,EAAE,WAAW,CAAC,CAAC,CAAC;AACnE,QAAM,YAAY,oBAAI,IAAI,CAAC,GAAM,GAAM,GAAM,IAAM,IAAM,IAAM,IAAM,EAAI,CAAC;AAC1E,WAAS,IAAI,IAAM,IAAI,KAAM,KAAK;AAChC,cAAU,IAAI,CAAC;AAAA,EACjB;AACA,WAAS,IAAI,KAAM,KAAK,KAAM,KAAK;AACjC,cAAU,IAAI,CAAC;AAAA,EACjB;AACA,MAAI;AACJ,MAAI,SAAS,MAAM,OAAK,UAAU,IAAI,CAAC,CAAC,GAAG;AACzC,iBAAa;AAAA,EACf,OAAO;AACL,iBAAa;AAAA,EACf;AACA,SAAO;AACT;AAMO,IAAM,aAAN,MAAiB;AAAA;AAAA,EAEtB;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AACZ,SAAK,WAAW,IAAI,IAAI,mBAAU;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAM;AACJ,WAAO,CAAC,GAAG,KAAK,QAAQ;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,IAAI,QAAQ;AACV,WAAO,KAAK,SAAS,IAAI,MAAM;AAAA,EACjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,IAAI,QAAQ;AACV,QAAI,CAAC,SAAS,MAAM,GAAG;AACrB,YAAM,IAAI,UAAU,2BAA2B,QAAQ,MAAM,IAAI;AAAA,IACnE,WAAW,oBAAoB,KAAK,MAAM,KAC/B,CAAC,uBAAuB,KAAK,MAAM,GAAG;AAC/C,YAAM,IAAI,MAAM,mBAAmB,QAAQ;AAAA,IAC7C;AACA,SAAK,SAAS,IAAI,MAAM;AACxB,WAAO,CAAC,GAAG,KAAK,QAAQ;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,QAAQ;AACb,WAAO,KAAK,SAAS,OAAO,MAAM;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK;AACT,QAAI;AACJ,QAAI,SAAS,GAAG,GAAG;AACjB,UAAI;AACF,cAAM,EAAE,SAAS,IAAI,IAAI,IAAI,GAAG;AAChC,cAAM,SAAS,SAAS,QAAQ,MAAM,EAAE;AACxC,cAAM,cAAc,OAAO,MAAM,GAAG;AACpC,cAAM,wBAAwB,KAAK,MAAM,KACnC,YAAY,MAAM,OAAK,KAAK,SAAS,IAAI,CAAC,CAAC;AAAA,MACnD,SAAS,GAAP;AACA,cAAM;AAAA,MACR;AAAA,IACF;AACA,WAAO,CAAC,CAAC;AAAA,EACX;AACF;AAGO,IAAM,eAAN,cAA2B,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAa3C,SAAS,KAAK,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,GAAG,YAAY,KAAK,GAAG;AAC7D,QAAI;AACJ,QAAI,MAAM,MAAM,GAAG,GAAG;AACpB,YAAM,EAAE,OAAO,MAAM,WAAW,IAAI,OAAO,CAAC;AAC5C,YAAM,EAAE,MAAM,UAAU,SAAS,IAAI,IAAI,IAAI,GAAG;AAChD,YAAM,SAAS,SAAS,QAAQ,MAAM,EAAE;AACxC,YAAM,cAAc,OAAO,MAAM,GAAG;AACpC,YAAM,YAAY,oBAAI,IAAI,CAAC,CAAC,QAAQ,KAAK,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC;AAC5D,UAAI,MAAM,QAAQ,KAAK,KAAK,MAAM,QAAQ;AACxC,cAAM,QAAQ,OAAO,OAAO,KAAK;AACjC,iBAAS,QAAQ,OAAO;AACtB,cAAI,SAAS,IAAI,GAAG;AAClB,mBAAO,KAAK,KAAK;AACjB,gBAAI,oBAAoB,KAAK,IAAI,GAAG;AAClC,wBAAU,IAAI,MAAM,KAAK;AAAA,YAC3B,WAAW,MAAM;AACf,wBAAU,IAAI,MAAM,IAAI;AAAA,YAC1B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI,MAAM,QAAQ,IAAI,KAAK,KAAK,QAAQ;AACtC,cAAM,QAAQ,OAAO,OAAO,IAAI;AAChC,iBAAS,QAAQ,OAAO;AACtB,cAAI,SAAS,IAAI,GAAG;AAClB,mBAAO,KAAK,KAAK;AACjB,gBAAI,MAAM;AACR,wBAAU,IAAI,MAAM,KAAK;AAAA,YAC3B;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,UAAI;AACJ,iBAAW,CAAC,KAAK,KAAK,KAAK,UAAU,QAAQ,GAAG;AAC9C,eAAO,SAAU,WAAW,OAAO,YAAY,MAAM,OAAK,MAAM,GAAG;AACnE,YAAI,CAAC,MAAM;AACT;AAAA,QACF;AAAA,MACF;AACA,UAAI,MAAM;AACR,YAAI,gBAAgB;AACpB,YAAI,YAAY,SAAS,MAAM,GAAG;AAChC,gBAAM,CAAC,QAAQ,IAAI,IAAI,SAAS,MAAM,GAAG;AACzC,gBAAM,YAAY,OAAO,MAAM,GAAG;AAClC,gBAAM,WAAW,UAAU,IAAI,MAAM;AACrC,cAAI,UAAU;AACZ,kBAAM,aAAa,YAAY,IAAI;AACnC,gBAAI,eAAe,MAAM;AACvB,8BAAgB,GAAG,UAAU,UAAU,KAAK,GAAG,KAAK;AAAA,YACtD;AAAA,UACF;AAAA,QACF;AACA,cAAM,CAAC,KAAK,IAAI,IAAI,MAAM,IAAI,IAC5B,CAAC,KAAK,KAAK,KAAK,KAAK,GAAG,EAAE,IAAI,mBAAmB;AACnD,cAAM,WAAW;AACjB,cAAM,SAAS,IAAI,OAAO,KAAK,GAAG;AAClC,cAAM,kBACJ,IAAI,OAAO,IAAI,MAAM,MAAM,QAAQ,SAAS,GAAG;AACjD,YAAI,YAAY,SAAS,MAAM,KAAK,EAAE,cAAc,OAAO;AACzD,yBAAe,cAAc,QAAQ,UAAU,mBAAmB,EAC/D,QAAQ,QAAQ,yBAAyB;AAAA,QAC9C,OAAO;AACL,yBAAe,cAAc,QAAQ,UAAU,mBAAmB,EAC/D,QAAQ,QAAQ,yBAAyB,EACzC,QAAQ,iBAAiB,yBAAyB;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AACA,WAAO,gBAAgB;AAAA,EACzB;AACF;AAEA,IAAM,eAAe,IAAI,aAAa;AAStC,IAAM,QAAQ,SAAO,aAAa,MAAM,GAAG;AAQpC,IAAM,QAAQ,OAAM,QAAO;AAChC,QAAM,MAAM,MAAM,MAAM,GAAG;AAC3B,SAAO;AACT;AASA,IAAM,cAAc,CAAC,KAAK,QAAQ,aAAa,SAAS,KAAK,OAAO;AAAA,EAClE,OAAO,CAAC;AAAA,EACR,MAAM,CAAC;AAAA,EACP,YAAY;AACd,CAAC;AASM,IAAM,cAAc,OAAO,KAAK,QAAQ;AAC7C,QAAM,MAAM,MAAM,YAAY,KAAK,GAAG;AACtC,SAAO;AACT;",
+  "names": []
+}

package/dist/url-sanitizer.min.js

@@ -0,0 +1,2 @@
+var l=e=>Object.prototype.toString.call(e).slice(8,-1),c=e=>typeof e=="string"||e instanceof String;var S=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","aim","amss","android","appdata","apt","ar","ark","attachment","aw","barion","beshare","bitcoin","bitcoincash","blob","bolo","browserext","cabal","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cvs","dab","dat","data","dav","diaspora","dict","did","dis","dlna-playcontainer","dlna-playsingle","dns","dntp","doi","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","http","https","hxxp","hxxps","hydrazone","hyper","iax","icap","icon","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lorawan","lpa","lvlt","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-powerpoint","ms-project","ms-publisher","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mumble","mupdate","mvn","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openpgp4fpr","otpauth","palm","paparazzi","payment","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcon","xcon-userid","xfire","xmlrpc.beep","xmlrpc.beeps","xmpp","xri","ymsgr","z39.50r","z39.50s"];var M=16,f=e=>{if(!c(e))throw new TypeError(`Expected String but got ${l(e)}.`);let s=[];for(let i of e)s.push(`%${i.charCodeAt(0).toString(M).toUpperCase()}`);return s.join("")},x=e=>{if(c(e))if(/^%[\dA-F]{2}$/i.test(e))e=e.toUpperCase();else throw new Error(`${e} is not a URL encoded character.`);else throw new TypeError(`Expected String but got ${l(e)}.`);let[s,i,a,o,t,m]=["&","#","<",">",'"',"'"].map(f),p;return e===s?p=`${s}amp;`:e===a?p=`${s}lt;`:e===o?p=`${s}gt;`:e===t?p=`${s}quot;`:e===m?p=`${s}${i}39;`:p=e,p},Y=e=>{if(!c(e))throw new TypeError(`Expected String but got ${l(e)}.`);let s=atob(e),i=Uint8Array.from([...s].map(t=>t.charCodeAt(0))),a=new Set([7,8,9,10,11,12,13,27]);for(let t=32;t<127;t++)a.add(t);for(let t=128;t<=255;t++)a.add(t);let o;return i.every(t=>a.has(t))?o=s:o=e,o},y=class{#e;constructor(){this.#e=new Set(S)}get(){return[...this.#e]}has(s){return this.#e.has(s)}add(s){if(c(s)){if(/(?:java|vb)script/.test(s)||!/^[a-z][a-z0-9+\-.]*$/.test(s))throw new Error(`Invalid scheme: ${s}`)}else throw new TypeError(`Expected String but got ${l(s)}.`);return this.#e.add(s),[...this.#e]}remove(s){return this.#e.delete(s)}isURI(s){let i;if(c(s))try{let{protocol:a}=new URL(s),o=a.replace(/:$/,""),t=o.split("+");i=/^(?:ext|web)\+[a-z]+$/.test(o)||t.every(m=>this.#e.has(m))}catch{i=!1}return!!i}},b=class extends y{sanitize(s,i={allow:[],deny:[],escapeTags:!0}){let a;if(super.isURI(s)){let{allow:o,deny:t,escapeTags:m}=i??{},{href:p,pathname:j,protocol:A}=new URL(s),g=A.replace(/:$/,""),u=g.split("+"),d=new Map([["data",!1],["file",!1]]);if(Array.isArray(o)&&o.length){let n=Object.values(o);for(let r of n)c(r)&&(r=r.trim(),/(?:java|vb)script/.test(r)?d.set(r,!1):r&&d.set(r,!0))}if(Array.isArray(t)&&t.length){let n=Object.values(t);for(let r of n)c(r)&&(r=r.trim(),r&&d.set(r,!1))}let h;for(let[n,r]of d.entries())if(h=r||g!==n&&u.every(w=>w!==n),!h)break;if(h){let n=p;if(u.includes("data")){let[L,z]=j.split(","),E=L.split(";");if(E.pop()==="base64"){let U=Y(z);U!==z&&(n=`${g}:${E.join(";")},${U}`)}}let[r,w,C,q,I]=["&","<",">",'"',"'"].map(f),k=/[<>"']/g,$=new RegExp(r,"g"),O=new RegExp(`(${w}|${C}|${q}|${I})`,"g");u.includes("data")&&!(m??!0)?a=n.replace(k,f).replace($,x):a=n.replace(k,f).replace($,x).replace(O,x)}}return a||null}},v=new b,T=e=>v.isURI(e),_=async e=>await T(e),R=(e,s)=>v.sanitize(e,s??{allow:[],deny:[],escapeTags:!0}),B=async(e,s)=>await R(e,s);export{v as default,_ as isURI,T as isURISync,B as sanitizeURL,R as sanitizeURLSync};
+//# sourceMappingURL=url-sanitizer.min.js.map