url-sanitizer 0.2.2 → 0.3.0

package/src/lib/file/text-chars.json

@@ -0,0 +1,233 @@
+[
+  7,
+  8,
+  9,
+  10,
+  11,
+  12,
+  13,
+  27,
+  32,
+  33,
+  34,
+  35,
+  36,
+  37,
+  38,
+  39,
+  40,
+  41,
+  42,
+  43,
+  44,
+  45,
+  46,
+  47,
+  48,
+  49,
+  50,
+  51,
+  52,
+  53,
+  54,
+  55,
+  56,
+  57,
+  58,
+  59,
+  60,
+  61,
+  62,
+  63,
+  64,
+  65,
+  66,
+  67,
+  68,
+  69,
+  70,
+  71,
+  72,
+  73,
+  74,
+  75,
+  76,
+  77,
+  78,
+  79,
+  80,
+  81,
+  82,
+  83,
+  84,
+  85,
+  86,
+  87,
+  88,
+  89,
+  90,
+  91,
+  92,
+  93,
+  94,
+  95,
+  96,
+  97,
+  98,
+  99,
+  100,
+  101,
+  102,
+  103,
+  104,
+  105,
+  106,
+  107,
+  108,
+  109,
+  110,
+  111,
+  112,
+  113,
+  114,
+  115,
+  116,
+  117,
+  118,
+  119,
+  120,
+  121,
+  122,
+  123,
+  124,
+  125,
+  126,
+  128,
+  129,
+  130,
+  131,
+  132,
+  133,
+  134,
+  135,
+  136,
+  137,
+  138,
+  139,
+  140,
+  141,
+  142,
+  143,
+  144,
+  145,
+  146,
+  147,
+  148,
+  149,
+  150,
+  151,
+  152,
+  153,
+  154,
+  155,
+  156,
+  157,
+  158,
+  159,
+  160,
+  161,
+  162,
+  163,
+  164,
+  165,
+  166,
+  167,
+  168,
+  169,
+  170,
+  171,
+  172,
+  173,
+  174,
+  175,
+  176,
+  177,
+  178,
+  179,
+  180,
+  181,
+  182,
+  183,
+  184,
+  185,
+  186,
+  187,
+  188,
+  189,
+  190,
+  191,
+  192,
+  193,
+  194,
+  195,
+  196,
+  197,
+  198,
+  199,
+  200,
+  201,
+  202,
+  203,
+  204,
+  205,
+  206,
+  207,
+  208,
+  209,
+  210,
+  211,
+  212,
+  213,
+  214,
+  215,
+  216,
+  217,
+  218,
+  219,
+  220,
+  221,
+  222,
+  223,
+  224,
+  225,
+  226,
+  227,
+  228,
+  229,
+  230,
+  231,
+  232,
+  233,
+  234,
+  235,
+  236,
+  237,
+  238,
+  239,
+  240,
+  241,
+  242,
+  243,
+  244,
+  245,
+  246,
+  247,
+  248,
+  249,
+  250,
+  251,
+  252,
+  253,
+  254,
+  255
+]

package/src/mjs/uri-util.js

@@ -4,6 +4,7 @@
 
 /* shared */
 import { getType, isString } from './common.js';
+import textCharTable from '../lib/file/text-chars.json' assert { type: 'json' };
 import uriSchemes from '../lib/iana/uri-schemes.json' assert { type: 'json' };
 
 /* constants */
@@ -64,7 +65,6 @@ export const escapeUrlEncodedHtmlChars = ch => {
 /**
  * parse base64
  *
- * @see {@link https://github.com/file/file/blob/master/src/encoding.c}
  * @param {string} data - base64 data
  * @returns {string} - parsed data / base64 data
  */
@@ -74,13 +74,7 @@ export const parseBase64 = data => {
   }
   const bin = atob(data);
   const uint8arr = Uint8Array.from([...bin].map(c => c.charCodeAt(0)));
-  const textChars = new Set([0x07, 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x1b]);
-  for (let i = 0x20; i < 0x7f; i++) {
-    textChars.add(i);
-  }
-  for (let i = 0x80; i <= 0xff; i++) {
-    textChars.add(i);
-  }
+  const textChars = new Set(textCharTable);
   let parsedData;
   if (uint8arr.every(c => textChars.has(c))) {
     parsedData = bin.replace(/\s/g, getUrlEncodedString);
@@ -180,6 +174,17 @@ export class URISchemes {
 
 /* URL sanitizer */
 export class URLSanitizer extends URISchemes {
+  /* private fields */
+  #recurse;
+
+  /**
+   * construct
+   */
+  constructor() {
+    super();
+    this.#recurse = new Map();
+  }
+
   /**
    * sanitize URL
    * NOTE: `data` and/or `file` schemes must be explicitly allowed
@@ -189,13 +194,12 @@ export class URLSanitizer extends URISchemes {
    * @param {object} opt - options
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
-   * @param {boolean} opt.escapeTags - escape tags and quotes in data URL
    * @returns {?string} - sanitized URL
    */
-  sanitize(url, opt = { allow: [], deny: [], escapeTags: true }) {
+  sanitize(url, opt = { allow: [], deny: [] }) {
     let sanitizedUrl;
     if (super.isURI(url)) {
-      const { allow, deny, escapeTags } = opt ?? {};
+      const { allow, deny } = opt ?? {};
       const { href, pathname, protocol } = new URL(url);
       const scheme = protocol.replace(/:$/, '');
       const schemeParts = scheme.split('+');
@@ -247,71 +251,60 @@ export class URLSanitizer extends URISchemes {
           if (isBase64) {
             let parsedData = parseBase64(data);
             if (parsedData !== data) {
-              const regDataUrl = /data:[^,]*;?base64,[\dA-Za-z+/\-_=]+/g;
-              if (regDataUrl.test(parsedData)) {
-                const dataUrlArr = [];
-                let arr = regDataUrl.exec(parsedData);
-                do {
-                  if (arr) {
-                    dataUrlArr.push(arr);
-                  }
-                } while ((arr = regDataUrl.exec(parsedData)));
-                if (dataUrlArr.length) {
-                  for (const i of dataUrlArr) {
-                    const [dataUrl] = i;
+              if (/data:[^,]*,/.test(parsedData)) {
+                const regDataUrl = /data:[^,]*,[^"]+/g;
+                const regBase64DataUrl = /data:[^,]*;?base64,[\dA-Za-z+/\-_=]+/;
+                const matchedDataUrls = parsedData.matchAll(regDataUrl);
+                const items = [...matchedDataUrls].reverse();
+                if (items.length) {
+                  for (const item of items) {
+                    const { index } = item;
+                    let [dataUrl] = item;
+                    if (regBase64DataUrl.test(dataUrl)) {
+                      [dataUrl] = regBase64DataUrl.exec(dataUrl);
+                    }
+                    const [beforeDataUrl, afterDataUrl] = [
+                      parsedData.substring(0, index),
+                      parsedData.substring(index + dataUrl.length)
+                    ];
+                    this.#recurse.set(dataUrl, dataUrl);
                     const parsedDataUrl = this.sanitize(dataUrl, {
                       allow: ['data']
                     });
                     if (parsedDataUrl) {
-                      parsedData = parsedData.replace(dataUrl, parsedDataUrl);
+                      parsedData = [
+                        beforeDataUrl,
+                        parsedDataUrl,
+                        afterDataUrl
+                      ].join('');
                     }
-                    type = 0;
                   }
                 }
-              } else if (/data:[^,]*,/.test(parsedData) &&
-                         !(escapeTags ?? true)) {
-                const dataArr = parsedData.split(/data:[^,]*,/);
-                const l = dataArr.length;
-                let i = 1;
-                while (i < l) {
-                  const dataItem = dataArr[i]
-                    .replace(regEncodedChars, escapeUrlEncodedHtmlChars);
-                  parsedData = parsedData.replace(dataArr[i], dataItem);
-                  i++;
-                }
-                type = 0;
               }
-              urlToSanitize = `${scheme}:${mediaType.join(';')},${parsedData}`;
-              if ((escapeTags ?? true)) {
+              if (this.#recurse.has(url)) {
+                this.#recurse.delete(url);
+              } else {
                 type = 1;
-              } else if (!Number.isInteger(type)) {
-                type = 2;
               }
-            } else if ((escapeTags ?? true)) {
-              type = 1;
+              urlToSanitize = `${scheme}:${mediaType.join(';')},${parsedData}`;
             } else {
-              type = 2;
+              type = 1;
             }
-          } else if ((escapeTags ?? true)) {
-            type = 1;
+          } else if (this.#recurse.has(url)) {
+            this.#recurse.delete(url);
           } else {
-            type = 2;
+            type = 1;
           }
         } else {
           type = 1;
         }
-        switch (type) {
-          case 1:
-            sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString)
-              .replace(regAmp, escapeUrlEncodedHtmlChars)
-              .replace(regEncodedChars, escapeUrlEncodedHtmlChars);
-            break;
-          case 2:
-            sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString)
-              .replace(regAmp, escapeUrlEncodedHtmlChars);
-            break;
-          default:
-            sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString);
+        if (type === 1) {
+          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString)
+            .replace(regAmp, escapeUrlEncodedHtmlChars)
+            .replace(regEncodedChars, escapeUrlEncodedHtmlChars);
+        } else {
+          sanitizedUrl = urlToSanitize.replace(regChars, getUrlEncodedString)
+            .replace(regAmp, escapeUrlEncodedHtmlChars);
         }
       }
     }
@@ -350,8 +343,7 @@ export const isURI = async uri => {
  */
 const sanitizeUrl = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
   allow: [],
-  deny: [],
-  escapeTags: true
+  deny: []
 });
 
 /**
@@ -359,7 +351,7 @@ const sanitizeUrl = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
  *
  * @param {string} url - URL input
  * @param {object} opt - options
- * @returns {Promise<?string>} - sanitized URL
+ * @returns {Promise.<?string>} - sanitized URL
  */
 export const sanitizeURL = async (url, opt) => {
   const res = await sanitizeUrl(url, opt);