url-sanitizer 0.7.1 → 0.7.2

package/README.md

@@ -45,6 +45,7 @@ Sanitize the given URL.
   * `opt.deny` **[Array][4]<[string][1]>** Array of denied schemes, e.g. `['web+foo']`.
   * `opt.only` **[Array][4]<[string][1]>** Array of specific schemes to allow, e.g. `['git', 'https']`.
     `only` takes precedence over `allow` and `deny`.
+  * `opt.truncate` **[boolean][2]** Truncate strings matching tags and quotes.
 
 Returns **[Promise][5]<[string][1]?>** Sanitized URL, `null`able.
 
@@ -110,6 +111,17 @@ const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)
 
 console.log(decodeURIComponent(res8));
 // => 'git+https://example.com/foo.git?&lt;script&gt;alert(1)&lt;/script&gt;'
+
+// Truncate the tag or quote and the rest of the URL following it.
+const res9 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
+  truncate: true
+});
+// => 'https://example.com/'
+
+const res10 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
+  truncate: true
+});
+// => 'https://example.com/?'
 ```
 
 
@@ -130,7 +142,7 @@ Returns **[Promise][5]<[ParsedURL](#parsedurl)>** Result.
 
 ### ParsedURL
 
-Object with enhanced properties based on [URL](https://developer.mozilla.org/ja/docs/Web/API/URL) API.
+Object with additional properties based on [URL](https://developer.mozilla.org/ja/docs/Web/API/URL) API.
 
 Type: [object][3]
 
@@ -157,11 +169,11 @@ Type: [object][3]
 ```javascript
 const res1 = await parseURL('javascript:alert(1)');
 /* => {
-  input: 'javascript:alert(1)',
-  valid: false
-} */
+        input: 'javascript:alert(1)',
+        valid: false
+      } */
 
-const res2 = await parseURL('https://example.com/?foo=bar#baz');
+const res2 = await parseURL('https://www.example.com/?foo=bar#baz');
 /* => {
         input: 'https://www.example.com/?foo=bar#baz',
         valid: true,
@@ -193,7 +205,7 @@ const res3 = await parseURL('data:image/svg+xml;base64,PHN2Zz48ZyBvbmNsaWNrPSJhb
         ...
       } */
 
-// base64 encoded png
+// base64 encoded PNG
 const res4 = await parseURL('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==');
 /* => {
         input: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==',

package/dist/url-sanitizer.js

@@ -1599,6 +1599,7 @@ var REG_DATA_URL = /data:[^,]*,[^"]+/g;
 var REG_DATA_URL_BASE64 = /data:[^,]*;?base64,[\da-z+/\-_=]+/i;
 var REG_HTML_SP = /[<>"'\s]/g;
 var REG_HTML_SP_URL_ENC = /%(?:2(?:2|7)|3(?:C|E))/g;
+var REG_HTML_SP_URL_ENC_SHORT = /%(?:2(?:2|7)|3(?:C|E))+?/;
 var REG_MIME_DOM = /^(?:text\/(?:ht|x)ml|application\/(?:xhtml\+)?xml|image\/svg\+xml)/;
 var REG_NUM_REF = /&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/ig;
 var REG_SCHEME = /^[a-z][\da-z+\-.]*$/;
@@ -1813,6 +1814,7 @@ var URLSanitizer = class extends URISchemes {
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
    * @param {Array.<string>} opt.only - array of specific schemes to allow
+   * @param {boolean} opt.truncate - truncate tag and/or quote and the rest
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt = { allow: [], deny: [], only: [] }) {
@@ -1820,7 +1822,7 @@ var URLSanitizer = class extends URISchemes {
       this.#nest = 0;
       throw new Error("Data URLs nested too deeply.");
     }
-    const { allow, deny, only } = opt ?? {};
+    const { allow, deny, only, truncate } = opt ?? {};
     const schemeMap = /* @__PURE__ */ new Map([
       ["data", false],
       ["file", false],
@@ -1970,6 +1972,11 @@ var URLSanitizer = class extends URISchemes {
         } else {
           escapeHtml = true;
         }
+        if (!schemeParts.includes("data") && truncate && REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
+          const item = REG_HTML_SP_URL_ENC_SHORT.exec(urlToSanitize);
+          const { index } = item;
+          urlToSanitize = urlToSanitize.substring(0, index);
+        }
         if (urlToSanitize) {
           sanitizedUrl = urlToSanitize.replace(REG_HTML_SP, getURLEncodedString).replace(REG_URL_ENC_AMP, escapeURLEncodedHTMLChars);
           if (escapeHtml) {
@@ -1985,7 +1992,7 @@ var URLSanitizer = class extends URISchemes {
     return sanitizedUrl || null;
   }
   /**
-   * object with extended props based on URL API
+   * object with additional properties based on URL API
    *
    * @typedef {object} ParsedURL
    * @property {string} input - URL input
@@ -2052,8 +2059,8 @@ var URLSanitizer = class extends URISchemes {
               parsedData.substring(0, index),
               parsedData.substring(index + htmlChar.length)
             ];
-            const unescapedHTMLChar = unescapeURLEncodedHTMLChars(htmlChar);
-            parsedData = `${preHtmlChar}${unescapedHTMLChar}${postHtmlChar}`;
+            const unescapedHtmlChar = unescapeURLEncodedHTMLChars(htmlChar);
+            parsedData = `${preHtmlChar}${unescapedHtmlChar}${postHtmlChar}`;
           }
           purifiedDom = purifyURLEncodedDOM(parsedData);
           dataUrl.set("data", purifiedDom);