url-sanitizer 0.7.2 → 0.7.4

package/README.md

@@ -45,7 +45,7 @@ Sanitize the given URL.
   * `opt.deny` **[Array][4]<[string][1]>** Array of denied schemes, e.g. `['web+foo']`.
   * `opt.only` **[Array][4]<[string][1]>** Array of specific schemes to allow, e.g. `['git', 'https']`.
     `only` takes precedence over `allow` and `deny`.
-  * `opt.truncate` **[boolean][2]** Truncate strings matching tags and quotes.
+  * `opt.remove` **[boolean][2]** Remove tag or quote and the rest following it.
 
 Returns **[Promise][5]<[string][1]?>** Sanitized URL, `null`able.
 
@@ -76,12 +76,12 @@ const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
 console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div>'
 
-const base64data4 = btoa('<div><iframe src="javascript:alert(1)"></iframe></div>');
+const base64data4 = btoa('<div><img src="javascript:alert(1)"></div>');
 const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
-// => 'data:text/html,%3Cdiv%3E%3C%2Fdiv%3E'
+// => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C%2Fdiv%3E'
 
 console.log(decodeURIComponent(res4));
-// => 'data:text/html,<div></div>'
+// => 'data:text/html,<div><img></div>'
 
 // Deny if the scheme matches the `deny` list
 const res5 = await sanitizeURL('web+foo://example.com', {
@@ -112,14 +112,14 @@ const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)
 console.log(decodeURIComponent(res8));
 // => 'git+https://example.com/foo.git?&lt;script&gt;alert(1)&lt;/script&gt;'
 
-// Truncate the tag or quote and the rest of the URL following it.
+// Remove the tag or quote and the rest of the URL following it.
 const res9 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
-  truncate: true
+  remove: true
 });
 // => 'https://example.com/'
 
 const res10 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
-  truncate: true
+  remove: true
 });
 // => 'https://example.com/?'
 ```

package/dist/url-sanitizer.js

@@ -1607,7 +1607,6 @@ var REG_SCHEME_CUSTOM = /^(?:ext|web)\+[a-z]+$/;
 var REG_SCRIPT = /(?:java|vb)script/;
 var REG_URL_ENC = /^%[\dA-F]{2}$/i;
 var REG_URL_ENC_AMP = /%26/g;
-var REG_URL_ENC_HTML_SP = /%26(?:(?:l|g|quo)t|%2339);?/g;
 var getURLEncodedString = (str) => {
   if (!isString(str)) {
     throw new TypeError(`Expected String but got ${getType(str)}.`);
@@ -1639,21 +1638,6 @@ var escapeURLEncodedHTMLChars = (ch) => {
   }
   return escapedChar;
 };
-var unescapeURLEncodedHTMLChars = (ch) => {
-  let unescapedChar;
-  if (/%26lt;?/.test(ch)) {
-    unescapedChar = "<";
-  } else if (/%26gt;?/.test(ch)) {
-    unescapedChar = ">";
-  } else if (/%26quot;?/.test(ch)) {
-    unescapedChar = '"';
-  } else if (/%26%2339;?/.test(ch)) {
-    unescapedChar = "'";
-  } else {
-    unescapedChar = ch;
-  }
-  return unescapedChar;
-};
 var parseBase64 = (data) => {
   if (!isString(data)) {
     throw new TypeError(`Expected String but got ${getType(data)}.`);
@@ -1711,12 +1695,6 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
   }
   return res;
 };
-var purifyURLEncodedDOM = (dom) => {
-  if (!isString(dom)) {
-    throw new TypeError(`Expected String but got ${getType(dom)}.`);
-  }
-  return encodeURIComponent(import_dompurify.default.sanitize(decodeURIComponent(dom)));
-};
 var URISchemes = class {
   /* private fields */
   #schemes;
@@ -1804,6 +1782,44 @@ var URLSanitizer = class extends URISchemes {
     this.#nest = 0;
     this.#recurse = /* @__PURE__ */ new Set();
   }
+  /**
+   * purify URL encoded DOM
+   *
+   * @param {string} dom - DOM input
+   * @returns {string} - purified DOM
+   */
+  purify(dom) {
+    if (!isString(dom)) {
+      throw new TypeError(`Expected String but got ${getType(dom)}.`);
+    }
+    let purifiedDom = import_dompurify.default.sanitize(decodeURIComponent(dom));
+    if (purifiedDom) {
+      const matchedDataUrls = purifiedDom.matchAll(REG_DATA_URL);
+      const items = [...matchedDataUrls].reverse();
+      for (const item of items) {
+        let [dataUrl] = item;
+        if (REG_DATA_URL_BASE64.test(dataUrl)) {
+          [dataUrl] = REG_DATA_URL_BASE64.exec(dataUrl);
+        }
+        this.#nest++;
+        this.#recurse.add(dataUrl);
+        const parsedDataUrl = this.sanitize(dataUrl, {
+          allow: ["data"]
+        });
+        const { index } = item;
+        const [preDataUrl, postDataUrl] = [
+          purifiedDom.substring(0, index),
+          purifiedDom.substring(index + dataUrl.length)
+        ];
+        if (parsedDataUrl) {
+          purifiedDom = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
+        } else {
+          purifiedDom = `${preDataUrl}${postDataUrl}`;
+        }
+      }
+    }
+    return encodeURIComponent(purifiedDom);
+  }
   /**
    * sanitize URL
    * NOTE: `data` and/or `file` schemes must be explicitly allowed
@@ -1814,7 +1830,7 @@ var URLSanitizer = class extends URISchemes {
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
    * @param {Array.<string>} opt.only - array of specific schemes to allow
-   * @param {boolean} opt.truncate - truncate tag and/or quote and the rest
+   * @param {boolean} opt.remove - remove tag and/or quote and the rest
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt = { allow: [], deny: [], only: [] }) {
@@ -1822,7 +1838,7 @@ var URLSanitizer = class extends URISchemes {
       this.#nest = 0;
       throw new Error("Data URLs nested too deeply.");
     }
-    const { allow, deny, only, truncate } = opt ?? {};
+    const { allow, deny, only, remove } = opt ?? {};
     const schemeMap = /* @__PURE__ */ new Map([
       ["data", false],
       ["file", false],
@@ -1914,9 +1930,9 @@ var URLSanitizer = class extends URISchemes {
           const [head, ...body] = pathname.split(",");
           const data = `${body.join(",")}${search}${hash}`;
           const mediaType = head.split(";");
+          const isBase64 = mediaType[mediaType.length - 1] === "base64";
           let parsedData = data;
-          if (mediaType[mediaType.length - 1] === "base64") {
-            mediaType.pop();
+          if (isBase64) {
             parsedData = parseBase64(data);
           } else {
             try {
@@ -1963,16 +1979,26 @@ var URLSanitizer = class extends URISchemes {
             } else {
               escapeHtml = true;
             }
-            urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
           } else if (this.#recurse.has(url)) {
             this.#recurse.delete(url);
           } else {
             escapeHtml = true;
           }
+          if (REG_MIME_DOM.test(head)) {
+            parsedData = this.purify(parsedData).replace(/%23$/, "").replace(/%3F$/, "");
+          }
+          if (urlToSanitize && parsedData) {
+            if (isBase64 && parsedData !== data) {
+              mediaType.pop();
+            }
+            urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
+          } else {
+            urlToSanitize = "";
+          }
         } else {
           escapeHtml = true;
         }
-        if (!schemeParts.includes("data") && truncate && REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
+        if (!schemeParts.includes("data") && remove && REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
           const item = REG_HTML_SP_URL_ENC_SHORT.exec(urlToSanitize);
           const { index } = item;
           urlToSanitize = urlToSanitize.substring(0, index);
@@ -1980,7 +2006,9 @@ var URLSanitizer = class extends URISchemes {
         if (urlToSanitize) {
           sanitizedUrl = urlToSanitize.replace(REG_HTML_SP, getURLEncodedString).replace(REG_URL_ENC_AMP, escapeURLEncodedHTMLChars);
           if (escapeHtml) {
-            sanitizedUrl = sanitizedUrl.replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
+            if (!schemeParts.includes("data")) {
+              sanitizedUrl = sanitizedUrl.replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
+            }
             this.#nest = 0;
           }
         } else {
@@ -2047,51 +2075,15 @@ var URLSanitizer = class extends URISchemes {
         }
         dataUrl.set("mime", mediaType.join(";"));
         dataUrl.set("base64", isBase64);
-        let purifiedDom;
-        if (!isBase64 && REG_MIME_DOM.test(head)) {
-          let parsedData = data;
-          const matchedHtmlChars = parsedData.matchAll(REG_URL_ENC_HTML_SP);
-          const items = [...matchedHtmlChars].reverse();
-          for (const item of items) {
-            const [htmlChar] = item;
-            const { index } = item;
-            const [preHtmlChar, postHtmlChar] = [
-              parsedData.substring(0, index),
-              parsedData.substring(index + htmlChar.length)
-            ];
-            const unescapedHtmlChar = unescapeURLEncodedHTMLChars(htmlChar);
-            parsedData = `${preHtmlChar}${unescapedHtmlChar}${postHtmlChar}`;
-          }
-          purifiedDom = purifyURLEncodedDOM(parsedData);
-          dataUrl.set("data", purifiedDom);
-        } else {
-          dataUrl.set("data", data);
-        }
+        dataUrl.set("data", data);
         parsedUrl.set("data", Object.fromEntries(dataUrl));
-        for (const key in urlObj) {
-          let value = urlObj[key];
-          if (isString(value)) {
-            if (isString(purifiedDom)) {
-              switch (key) {
-                case "href":
-                  value = `${protocol}${mediaType.join(";")},${purifiedDom}`;
-                  break;
-                case "pathname":
-                  value = `${mediaType.join(";")},${purifiedDom}`;
-                  break;
-                default:
-              }
-            }
-            parsedUrl.set(key, value);
-          }
-        }
       } else {
         parsedUrl.set("data", null);
-        for (const key in urlObj) {
-          const value = urlObj[key];
-          if (isString(value)) {
-            parsedUrl.set(key, value);
-          }
+      }
+      for (const key in urlObj) {
+        const value = urlObj[key];
+        if (isString(value)) {
+          parsedUrl.set(key, value);
         }
       }
     } else {