url-sanitizer 0.7.0 → 0.7.2

package/README.md

@@ -45,6 +45,7 @@ Sanitize the given URL.
   * `opt.deny` **[Array][4]<[string][1]>** Array of denied schemes, e.g. `['web+foo']`.
   * `opt.only` **[Array][4]<[string][1]>** Array of specific schemes to allow, e.g. `['git', 'https']`.
     `only` takes precedence over `allow` and `deny`.
+  * `opt.truncate` **[boolean][2]** Truncate strings matching tags and quotes.
 
 Returns **[Promise][5]<[string][1]?>** Sanitized URL, `null`able.
 
@@ -82,11 +83,13 @@ const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
 console.log(decodeURIComponent(res4));
 // => 'data:text/html,<div></div>'
 
+// Deny if the scheme matches the `deny` list
 const res5 = await sanitizeURL('web+foo://example.com', {
   deny: ['web+foo']
 });
 // => null
 
+// Allow only if the scheme matches the `only` list
 const res6 = await sanitizeURL('http://example.com', {
   only: ['data', 'git', 'https']
 });
@@ -100,7 +103,7 @@ const res7 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
 console.log(decodeURIComponent(res7));
 // => 'https://example.com/&quot;onmouseover=&quot;alert(1)&quot;'
 
-// `only` option also allows combinations of the specified schemes
+// `only` also allows combination of the schemes in the list
 const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
   only: ['data', 'git', 'https']
 });
@@ -108,6 +111,17 @@ const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)
 
 console.log(decodeURIComponent(res8));
 // => 'git+https://example.com/foo.git?&lt;script&gt;alert(1)&lt;/script&gt;'
+
+// Truncate the tag or quote and the rest of the URL following it.
+const res9 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
+  truncate: true
+});
+// => 'https://example.com/'
+
+const res10 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
+  truncate: true
+});
+// => 'https://example.com/?'
 ```
 
 
@@ -128,7 +142,7 @@ Returns **[Promise][5]<[ParsedURL](#parsedurl)>** Result.
 
 ### ParsedURL
 
-Object with extended properties based on [URL](https://developer.mozilla.org/ja/docs/Web/API/URL) API.
+Object with additional properties based on [URL](https://developer.mozilla.org/ja/docs/Web/API/URL) API.
 
 Type: [object][3]
 
@@ -150,17 +164,16 @@ Type: [object][3]
 * `port` **[string][1]** Port number of the sanitized URL.
 * `pathname` **[string][1]** Path of the sanitized URL.
 * `search` **[string][1]** Query string of the sanitized URL.
-* `searchParams` **[object][3]** [URLSearchParams](https://developer.mozilla.org/en-US/docs/Web/API/URLSearchParams) object.
 * `hash` **[string][1]** Fragment identifier of the sanitized URL.
 
 ```javascript
 const res1 = await parseURL('javascript:alert(1)');
 /* => {
-  input: 'javascript:alert(1)',
-  valid: false
-} */
+        input: 'javascript:alert(1)',
+        valid: false
+      } */
 
-const res2 = await parseURL('https://example.com/?foo=bar#baz');
+const res2 = await parseURL('https://www.example.com/?foo=bar#baz');
 /* => {
         input: 'https://www.example.com/?foo=bar#baz',
         valid: true,
@@ -192,7 +205,7 @@ const res3 = await parseURL('data:image/svg+xml;base64,PHN2Zz48ZyBvbmNsaWNrPSJhb
         ...
       } */
 
-// base64 encoded png
+// base64 encoded PNG
 const res4 = await parseURL('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==');
 /* => {
         input: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==',
@@ -218,7 +231,7 @@ Synchronous version of the [parseURL()](#parseURL).
 
 ## isURI(uri)
 
-Determines whether the given URI is valid.
+Verify if the given URI is valid.
 
 ### Parameters
 

package/dist/url-sanitizer.js

@@ -1597,9 +1597,10 @@ var HEX = 16;
 var REG_BASE64 = /^[\da-z+/\-_=]+$/i;
 var REG_DATA_URL = /data:[^,]*,[^"]+/g;
 var REG_DATA_URL_BASE64 = /data:[^,]*;?base64,[\da-z+/\-_=]+/i;
-var REG_MIME_DOM = /^(?:text\/(?:ht|x)ml|application\/(?:xhtml\+)?xml|image\/svg\+xml)/;
 var REG_HTML_SP = /[<>"'\s]/g;
 var REG_HTML_SP_URL_ENC = /%(?:2(?:2|7)|3(?:C|E))/g;
+var REG_HTML_SP_URL_ENC_SHORT = /%(?:2(?:2|7)|3(?:C|E))+?/;
+var REG_MIME_DOM = /^(?:text\/(?:ht|x)ml|application\/(?:xhtml\+)?xml|image\/svg\+xml)/;
 var REG_NUM_REF = /&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/ig;
 var REG_SCHEME = /^[a-z][\da-z+\-.]*$/;
 var REG_SCHEME_CUSTOM = /^(?:ext|web)\+[a-z]+$/;
@@ -1607,7 +1608,7 @@ var REG_SCRIPT = /(?:java|vb)script/;
 var REG_URL_ENC = /^%[\dA-F]{2}$/i;
 var REG_URL_ENC_AMP = /%26/g;
 var REG_URL_ENC_HTML_SP = /%26(?:(?:l|g|quo)t|%2339);?/g;
-var getUrlEncodedString = (str) => {
+var getURLEncodedString = (str) => {
   if (!isString(str)) {
     throw new TypeError(`Expected String but got ${getType(str)}.`);
   }
@@ -1617,17 +1618,11 @@ var getUrlEncodedString = (str) => {
   }
   return chars.join("");
 };
-var escapeUrlEncodedHtmlChars = (ch) => {
-  if (isString(ch)) {
-    if (REG_URL_ENC.test(ch)) {
-      ch = ch.toUpperCase();
-    } else {
-      throw new Error(`Invalid URL encoded character: ${ch}`);
-    }
-  } else {
-    throw new TypeError(`Expected String but got ${getType(ch)}.`);
+var escapeURLEncodedHTMLChars = (ch) => {
+  if (isString(ch) && REG_URL_ENC.test(ch)) {
+    ch = ch.toUpperCase();
   }
-  const [amp, num, lt, gt, quot, apos] = ["&", "#", "<", ">", '"', "'"].map(getUrlEncodedString);
+  const [amp, num, lt, gt, quot, apos] = ["&", "#", "<", ">", '"', "'"].map(getURLEncodedString);
   let escapedChar;
   if (ch === amp) {
     escapedChar = `${amp}amp;`;
@@ -1644,7 +1639,7 @@ var escapeUrlEncodedHtmlChars = (ch) => {
   }
   return escapedChar;
 };
-var unescapeUrlEncodedHtmlChars = (ch) => {
+var unescapeURLEncodedHTMLChars = (ch) => {
   let unescapedChar;
   if (/%26lt;?/.test(ch)) {
     unescapedChar = "<";
@@ -1670,13 +1665,13 @@ var parseBase64 = (data) => {
   const textCharCodes = new Set(text_chars_default);
   let parsedData;
   if (uint8arr.every((c) => textCharCodes.has(c))) {
-    parsedData = bin.replace(/\s/g, getUrlEncodedString);
+    parsedData = bin.replace(/\s/g, getURLEncodedString);
   } else {
     parsedData = data;
   }
   return parsedData;
 };
-var parseUrlEncodedNumCharRef = (str, nest = 0) => {
+var parseURLEncodedNumCharRef = (str, nest = 0) => {
   if (!isString(str)) {
     throw new TypeError(`Expected String but got ${getType(str)}.`);
   }
@@ -1706,7 +1701,7 @@ var parseUrlEncodedNumCharRef = (str, nest = 0) => {
         if (textCharCodes.has(num)) {
           res = `${preNum}${String.fromCharCode(num)}${postNum}`;
           if (/#x?$/.test(preNum) || /^#(?:x(?:00)?[2-7]|\d)/.test(postNum)) {
-            res = parseUrlEncodedNumCharRef(res, ++nest);
+            res = parseURLEncodedNumCharRef(res, ++nest);
           }
         } else if (num < HEX * HEX) {
           res = `${preNum}${postNum}`;
@@ -1716,7 +1711,7 @@ var parseUrlEncodedNumCharRef = (str, nest = 0) => {
   }
   return res;
 };
-var purifyUrlEncodedDom = (dom) => {
+var purifyURLEncodedDOM = (dom) => {
   if (!isString(dom)) {
     throw new TypeError(`Expected String but got ${getType(dom)}.`);
   }
@@ -1777,12 +1772,12 @@ var URISchemes = class {
     return this.#schemes.delete(scheme);
   }
   /**
-   * is URI
+   * verify URI
    *
    * @param {string} uri - URI input
    * @returns {boolean} - result
    */
-  isURI(uri) {
+  verify(uri) {
     let res;
     if (isString(uri)) {
       try {
@@ -1819,6 +1814,7 @@ var URLSanitizer = class extends URISchemes {
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
    * @param {Array.<string>} opt.only - array of specific schemes to allow
+   * @param {boolean} opt.truncate - truncate tag and/or quote and the rest
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt = { allow: [], deny: [], only: [] }) {
@@ -1826,7 +1822,7 @@ var URLSanitizer = class extends URISchemes {
       this.#nest = 0;
       throw new Error("Data URLs nested too deeply.");
     }
-    const { allow, deny, only } = opt ?? {};
+    const { allow, deny, only, truncate } = opt ?? {};
     const schemeMap = /* @__PURE__ */ new Map([
       ["data", false],
       ["file", false],
@@ -1896,7 +1892,7 @@ var URLSanitizer = class extends URISchemes {
       }
     }
     let sanitizedUrl;
-    if (super.isURI(url)) {
+    if (super.verify(url)) {
       const { hash, href, pathname, protocol, search } = new URL(url);
       const scheme = protocol.replace(/:$/, "");
       const schemeParts = scheme.split("+");
@@ -1924,7 +1920,7 @@ var URLSanitizer = class extends URISchemes {
             parsedData = parseBase64(data);
           } else {
             try {
-              const decodedData = parseUrlEncodedNumCharRef(parsedData);
+              const decodedData = parseURLEncodedNumCharRef(parsedData);
               const { protocol: dataScheme } = new URL(decodedData.trim());
               const dataSchemeParts = dataScheme.replace(/:$/, "").split("+");
               if (dataSchemeParts.some((s) => REG_SCRIPT.test(s))) {
@@ -1976,10 +1972,15 @@ var URLSanitizer = class extends URISchemes {
         } else {
           escapeHtml = true;
         }
+        if (!schemeParts.includes("data") && truncate && REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
+          const item = REG_HTML_SP_URL_ENC_SHORT.exec(urlToSanitize);
+          const { index } = item;
+          urlToSanitize = urlToSanitize.substring(0, index);
+        }
         if (urlToSanitize) {
-          sanitizedUrl = urlToSanitize.replace(REG_HTML_SP, getUrlEncodedString).replace(REG_URL_ENC_AMP, escapeUrlEncodedHtmlChars);
+          sanitizedUrl = urlToSanitize.replace(REG_HTML_SP, getURLEncodedString).replace(REG_URL_ENC_AMP, escapeURLEncodedHTMLChars);
           if (escapeHtml) {
-            sanitizedUrl = sanitizedUrl.replace(REG_HTML_SP_URL_ENC, escapeUrlEncodedHtmlChars);
+            sanitizedUrl = sanitizedUrl.replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
             this.#nest = 0;
           }
         } else {
@@ -1991,7 +1992,7 @@ var URLSanitizer = class extends URISchemes {
     return sanitizedUrl || null;
   }
   /**
-   * object with extended props based on URL API
+   * object with additional properties based on URL API
    *
    * @typedef {object} ParsedURL
    * @property {string} input - URL input
@@ -2018,7 +2019,7 @@ var URLSanitizer = class extends URISchemes {
    *
    * @param {string} url - URL input
    * @param {object} opt - options
-   * @returns {ParsedURL} - result with extended props based on URL API
+   * @returns {ParsedURL} - result with enhanced props based on URL API
    */
   parse(url, opt) {
     if (!isString(url)) {
@@ -2058,10 +2059,10 @@ var URLSanitizer = class extends URISchemes {
               parsedData.substring(0, index),
               parsedData.substring(index + htmlChar.length)
             ];
-            const unescapedHTMLChar = unescapeUrlEncodedHtmlChars(htmlChar);
-            parsedData = `${preHtmlChar}${unescapedHTMLChar}${postHtmlChar}`;
+            const unescapedHtmlChar = unescapeURLEncodedHTMLChars(htmlChar);
+            parsedData = `${preHtmlChar}${unescapedHtmlChar}${postHtmlChar}`;
           }
-          purifiedDom = purifyUrlEncodedDom(parsedData);
+          purifiedDom = purifyURLEncodedDOM(parsedData);
           dataUrl.set("data", purifiedDom);
         } else {
           dataUrl.set("data", data);
@@ -2100,12 +2101,17 @@ var URLSanitizer = class extends URISchemes {
   }
 };
 var urlSanitizer = new URLSanitizer();
-var isUri = (uri) => urlSanitizer.isURI(uri);
+var isURISync = (uri) => urlSanitizer.verify(uri);
 var isURI = async (uri) => {
-  const res = await isUri(uri);
+  const res = await isURISync(uri);
   return res;
 };
-var sanitizeUrl = (url, opt) => {
+var parseURLSync = (url) => urlSanitizer.parse(url);
+var parseURL = async (url) => {
+  const res = await parseURLSync(url);
+  return res;
+};
+var sanitizeURLSync = (url, opt) => {
   const parsedUrl = urlSanitizer.parse(url, opt ?? {
     allow: [],
     deny: [],
@@ -2119,22 +2125,17 @@ var sanitizeUrl = (url, opt) => {
   return res ?? null;
 };
 var sanitizeURL = async (url, opt) => {
-  const res = await sanitizeUrl(url, opt);
-  return res;
-};
-var parseUrl = (url) => urlSanitizer.parse(url);
-var parseURL = async (url) => {
-  const res = await parseUrl(url);
+  const res = await sanitizeURLSync(url, opt);
   return res;
 };
 export {
   urlSanitizer as default,
   isURI,
-  isUri as isURISync,
+  isURISync,
   parseURL,
-  parseUrl as parseURLSync,
+  parseURLSync,
   sanitizeURL,
-  sanitizeUrl as sanitizeURLSync
+  sanitizeURLSync
 };
 /*!
  * URL Sanitizer