url-sanitizer 0.7.2 → 0.7.3

package/README.md

@@ -45,7 +45,7 @@ Sanitize the given URL.
   * `opt.deny` **[Array][4]<[string][1]>** Array of denied schemes, e.g. `['web+foo']`.
   * `opt.only` **[Array][4]<[string][1]>** Array of specific schemes to allow, e.g. `['git', 'https']`.
     `only` takes precedence over `allow` and `deny`.
-  * `opt.truncate` **[boolean][2]** Truncate strings matching tags and quotes.
+  * `opt.remove` **[boolean][2]** Remove tag or quote and the rest following it.
 
 Returns **[Promise][5]<[string][1]?>** Sanitized URL, `null`able.
 
@@ -76,12 +76,12 @@ const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
 console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div>'
 
-const base64data4 = btoa('<div><iframe src="javascript:alert(1)"></iframe></div>');
+const base64data4 = btoa('<div><img src="javascript:alert(1)"></div>');
 const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
-// => 'data:text/html,%3Cdiv%3E%3C%2Fdiv%3E'
+// => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C%2Fdiv%3E'
 
 console.log(decodeURIComponent(res4));
-// => 'data:text/html,<div></div>'
+// => 'data:text/html,<div><img></div>'
 
 // Deny if the scheme matches the `deny` list
 const res5 = await sanitizeURL('web+foo://example.com', {
@@ -112,14 +112,14 @@ const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)
 console.log(decodeURIComponent(res8));
 // => 'git+https://example.com/foo.git?&lt;script&gt;alert(1)&lt;/script&gt;'
 
-// Truncate the tag or quote and the rest of the URL following it.
+// Remove the tag or quote and the rest of the URL following it.
 const res9 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
-  truncate: true
+  remove: true
 });
 // => 'https://example.com/'
 
 const res10 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
-  truncate: true
+  remove: true
 });
 // => 'https://example.com/?'
 ```

package/package.json

@@ -48,7 +48,7 @@
     "eslint": "^8.33.0",
     "eslint-config-standard": "^17.0.0",
     "eslint-plugin-import": "^2.27.5",
-    "eslint-plugin-jsdoc": "^39.7.5",
+    "eslint-plugin-jsdoc": "^39.8.0",
     "eslint-plugin-n": "^15.6.1",
     "eslint-plugin-node": "^11.1.0",
     "eslint-plugin-promise": "^6.1.1",
@@ -58,5 +58,5 @@
     "sinon": "^15.0.1",
     "undici": "^5.16.0"
   },
-  "version": "0.7.2"
+  "version": "0.7.3"
 }

package/src/mjs/uri-util.js

@@ -24,7 +24,6 @@ const REG_SCHEME_CUSTOM = /^(?:ext|web)\+[a-z]+$/;
 const REG_SCRIPT = /(?:java|vb)script/;
 const REG_URL_ENC = /^%[\dA-F]{2}$/i;
 const REG_URL_ENC_AMP = /%26/g;
-const REG_URL_ENC_HTML_SP = /%26(?:(?:l|g|quo)t|%2339);?/g;
 
 /**
  * get URL encoded string
@@ -166,19 +165,6 @@ export const parseURLEncodedNumCharRef = (str, nest = 0) => {
   return res;
 };
 
-/**
- * purify URL encoded DOM
- *
- * @param {string} dom - DOM input
- * @returns {string} - purified DOM
- */
-export const purifyURLEncodedDOM = dom => {
-  if (!isString(dom)) {
-    throw new TypeError(`Expected String but got ${getType(dom)}.`);
-  }
-  return encodeURIComponent(domPurify.sanitize(decodeURIComponent(dom)));
-};
-
 /**
  * URI schemes
  *
@@ -281,6 +267,45 @@ export class URLSanitizer extends URISchemes {
     this.#recurse = new Set();
   }
 
+  /**
+   * purify URL encoded DOM
+   *
+   * @param {string} dom - DOM input
+   * @returns {string} - purified DOM
+   */
+  purify(dom) {
+    if (!isString(dom)) {
+      throw new TypeError(`Expected String but got ${getType(dom)}.`);
+    }
+    let purifiedDom = domPurify.sanitize(decodeURIComponent(dom));
+    if (purifiedDom) {
+      const matchedDataUrls = purifiedDom.matchAll(REG_DATA_URL);
+      const items = [...matchedDataUrls].reverse();
+      for (const item of items) {
+        let [dataUrl] = item;
+        if (REG_DATA_URL_BASE64.test(dataUrl)) {
+          [dataUrl] = REG_DATA_URL_BASE64.exec(dataUrl);
+        }
+        this.#nest++;
+        this.#recurse.add(dataUrl);
+        const parsedDataUrl = this.sanitize(dataUrl, {
+          allow: ['data']
+        });
+        const { index } = item;
+        const [preDataUrl, postDataUrl] = [
+          purifiedDom.substring(0, index),
+          purifiedDom.substring(index + dataUrl.length)
+        ];
+        if (parsedDataUrl) {
+          purifiedDom = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
+        } else {
+          purifiedDom = `${preDataUrl}${postDataUrl}`;
+        }
+      }
+    }
+    return encodeURIComponent(purifiedDom);
+  };
+
   /**
    * sanitize URL
    * NOTE: `data` and/or `file` schemes must be explicitly allowed
@@ -291,7 +316,7 @@ export class URLSanitizer extends URISchemes {
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
    * @param {Array.<string>} opt.only - array of specific schemes to allow
-   * @param {boolean} opt.truncate - truncate tag and/or quote and the rest
+   * @param {boolean} opt.remove - remove tag and/or quote and the rest
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt = { allow: [], deny: [], only: [] }) {
@@ -299,7 +324,7 @@ export class URLSanitizer extends URISchemes {
       this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
-    const { allow, deny, only, truncate } = opt ?? {};
+    const { allow, deny, only, remove } = opt ?? {};
     const schemeMap = new Map([
       ['data', false],
       ['file', false],
@@ -393,9 +418,9 @@ export class URLSanitizer extends URISchemes {
           const [head, ...body] = pathname.split(',');
           const data = `${body.join(',')}${search}${hash}`;
           const mediaType = head.split(';');
+          const isBase64 = mediaType[mediaType.length - 1] === 'base64';
           let parsedData = data;
-          if (mediaType[mediaType.length - 1] === 'base64') {
-            mediaType.pop();
+          if (isBase64) {
             parsedData = parseBase64(data);
           } else {
             try {
@@ -443,16 +468,27 @@ export class URLSanitizer extends URISchemes {
             } else {
               escapeHtml = true;
             }
-            urlToSanitize = `${scheme}:${mediaType.join(';')},${parsedData}`;
           } else if (this.#recurse.has(url)) {
             this.#recurse.delete(url);
           } else {
             escapeHtml = true;
           }
+          if (REG_MIME_DOM.test(head)) {
+            parsedData =
+              this.purify(parsedData).replace(/%23$/, '').replace(/%3F$/, '');
+          }
+          if (urlToSanitize && parsedData) {
+            if (isBase64 && parsedData !== data) {
+              mediaType.pop();
+            }
+            urlToSanitize = `${scheme}:${mediaType.join(';')},${parsedData}`;
+          } else {
+            urlToSanitize = '';
+          }
         } else {
           escapeHtml = true;
         }
-        if (!schemeParts.includes('data') && truncate &&
+        if (!schemeParts.includes('data') && remove &&
             REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
           const item = REG_HTML_SP_URL_ENC_SHORT.exec(urlToSanitize);
           const { index } = item;
@@ -463,8 +499,10 @@ export class URLSanitizer extends URISchemes {
             .replace(REG_HTML_SP, getURLEncodedString)
             .replace(REG_URL_ENC_AMP, escapeURLEncodedHTMLChars);
           if (escapeHtml) {
-            sanitizedUrl = sanitizedUrl
-              .replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
+            if (!schemeParts.includes('data')) {
+              sanitizedUrl = sanitizedUrl
+                .replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
+            }
             this.#nest = 0;
           }
         } else {
@@ -533,51 +571,15 @@ export class URLSanitizer extends URISchemes {
         }
         dataUrl.set('mime', mediaType.join(';'));
         dataUrl.set('base64', isBase64);
-        let purifiedDom;
-        if (!isBase64 && REG_MIME_DOM.test(head)) {
-          let parsedData = data;
-          const matchedHtmlChars = parsedData.matchAll(REG_URL_ENC_HTML_SP);
-          const items = [...matchedHtmlChars].reverse();
-          for (const item of items) {
-            const [htmlChar] = item;
-            const { index } = item;
-            const [preHtmlChar, postHtmlChar] = [
-              parsedData.substring(0, index),
-              parsedData.substring(index + htmlChar.length)
-            ];
-            const unescapedHtmlChar = unescapeURLEncodedHTMLChars(htmlChar);
-            parsedData = `${preHtmlChar}${unescapedHtmlChar}${postHtmlChar}`;
-          }
-          purifiedDom = purifyURLEncodedDOM(parsedData);
-          dataUrl.set('data', purifiedDom);
-        } else {
-          dataUrl.set('data', data);
-        }
+        dataUrl.set('data', data);
         parsedUrl.set('data', Object.fromEntries(dataUrl));
-        for (const key in urlObj) {
-          let value = urlObj[key];
-          if (isString(value)) {
-            if (isString(purifiedDom)) {
-              switch (key) {
-                case 'href':
-                  value = `${protocol}${mediaType.join(';')},${purifiedDom}`;
-                  break;
-                case 'pathname':
-                  value = `${mediaType.join(';')},${purifiedDom}`;
-                  break;
-                default:
-              }
-            }
-            parsedUrl.set(key, value);
-          }
-        }
       } else {
         parsedUrl.set('data', null);
-        for (const key in urlObj) {
-          const value = urlObj[key];
-          if (isString(value)) {
-            parsedUrl.set(key, value);
-          }
+      }
+      for (const key in urlObj) {
+        const value = urlObj[key];
+        if (isString(value)) {
+          parsedUrl.set(key, value);
         }
       }
     } else {