url-sanitizer 0.7.3 → 0.7.5

package/README.md

@@ -35,7 +35,7 @@ import urlSanitizer, {
 ## sanitizeURL(url, opt)
 
 Sanitize the given URL.
-* `data` and `file` schemes must be explicitly allowed.
+* `blob`, `data` and `file` schemes must be explicitly allowed.
 
 ### Parameters
 
@@ -61,7 +61,7 @@ console.log(decodeURIComponent(res1));
 const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
   allow: ['data']
 })
-// -> 'data:text/html,%3Cdiv%3E%3C%2Fdiv%3E%3Cp%3E%3C%2Fp%3E'
+// -> 'data:text/html,%3Cdiv%3E%3C/div%3E%3Cp%3E%3C/p%3E'
 
 console.log(decodeURIComponent(res2));
 // => 'data:text/html,<div></div><p></p>'
@@ -71,14 +71,14 @@ const base64data3 = btoa('<div><script>alert(1);</script></div>');
 const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
   allow: ['data']
 })
-// => 'data:text/html,%3Cdiv%3E%3C%2Fdiv%3E'
+// => 'data:text/html,%3Cdiv%3E%3C/div%3E'
 
 console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div>'
 
 const base64data4 = btoa('<div><img src="javascript:alert(1)"></div>');
 const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
-// => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C%2Fdiv%3E'
+// => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C/div%3E'
 
 console.log(decodeURIComponent(res4));
 // => 'data:text/html,<div><img></div>'
@@ -152,7 +152,7 @@ Type: [object][3]
 * `valid` **[boolean][2]** Is valid URI.
 * `data` **[object][3]** Parsed result of data URL, `null`able.
   * `data.mime` **[string][1]** MIME type.
-  * `data.base64` **[boolean][2]** `true` if base64 encoded.
+  * `data.base64` **[boolean][2]** Is base64 encoded.
   * `data.data` **[string][1]** Data part of the data URL.
 * `href` **[string][1]** Sanitized URL input.
 * `origin` **[string][1]** Scheme, domain and port of the sanitized URL.
@@ -196,12 +196,12 @@ const res3 = await parseURL('data:image/svg+xml;base64,PHN2Zz48ZyBvbmNsaWNrPSJhb
         data: {
           mime: 'image/svg+xml',
           base64: false,
-          data: '%3Csvg%3E%3Cg%3E%3C%2Fg%3E%3C%2Fsvg%3E'
+          data: '%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E'
         },
-        href: 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C%2Fg%3E%3C%2Fsvg%3E',
+        href: 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E',
         origin: 'null',
         protocol: 'data:',
-        pathname: 'image/svg+xml,%3Csvg%3E%3Cg%3E%3C%2Fg%3E%3C%2Fsvg%3E',
+        pathname: 'image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E',
         ...
       } */
 
@@ -231,7 +231,7 @@ Synchronous version of the [parseURL()](#parseURL).
 
 ## isURI(uri)
 
-Verify if the given URI is valid.
+Verify if the given URI is valid and registered.
 
 ### Parameters
 
@@ -239,6 +239,7 @@ Verify if the given URI is valid.
 
 Returns **[Promise][5]<[boolean][2]>** Result.
 * Always `true` for `web+*` and `ext+*` schemes, except `web+javascript`, `web+vbscript`, `ext+javascript`, `ext+vbscript`.
+* `false` for `javascript` and `vbscript` schemes.
 
 ```javascript
 const res1 = await isURI('https://example.com/foo');

package/dist/url-sanitizer.js

@@ -1595,19 +1595,26 @@ var uri_schemes_default = [
 // bundle/mjs/uri-util.js
 var HEX = 16;
 var REG_BASE64 = /^[\da-z+/\-_=]+$/i;
-var REG_DATA_URL = /data:[^,]*,[^"]+/g;
+var REG_DATA_URL = /data:[^,]*,/;
 var REG_DATA_URL_BASE64 = /data:[^,]*;?base64,[\da-z+/\-_=]+/i;
+var REG_DATA_URL_G = /data:[^,]*,[^"]+/g;
+var REG_END_COLON = /:$/;
+var REG_END_NUM = /(?:#|%23)$/;
+var REG_END_QUEST = /(?<!(?:#|%23).*)(?:\?|%3F)$/;
 var REG_HTML_SP = /[<>"'\s]/g;
-var REG_HTML_SP_URL_ENC = /%(?:2(?:2|7)|3(?:C|E))/g;
-var REG_HTML_SP_URL_ENC_SHORT = /%(?:2(?:2|7)|3(?:C|E))+?/;
+var REG_HTML_URL_ENC = /%(?:2(?:2|7)|3(?:C|E))/g;
+var REG_HTML_URL_ENC_SHORT = /%(?:2(?:2|7)|3(?:C|E))+?/;
 var REG_MIME_DOM = /^(?:text\/(?:ht|x)ml|application\/(?:xhtml\+)?xml|image\/svg\+xml)/;
+var REG_NUM_DECI = /^\d+/;
+var REG_NUM_HEAD = /#x?$/;
+var REG_NUM_HEAD_ASCII = /^#(?:x(?:00)?[2-7]|\d)/;
+var REG_NUM_HEX = /^x[\dA-F]+/i;
 var REG_NUM_REF = /&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/ig;
 var REG_SCHEME = /^[a-z][\da-z+\-.]*$/;
 var REG_SCHEME_CUSTOM = /^(?:ext|web)\+[a-z]+$/;
 var REG_SCRIPT = /(?:java|vb)script/;
 var REG_URL_ENC = /^%[\dA-F]{2}$/i;
 var REG_URL_ENC_AMP = /%26/g;
-var REG_URL_ENC_HTML_SP = /%26(?:(?:l|g|quo)t|%2339);?/g;
 var getURLEncodedString = (str) => {
   if (!isString(str)) {
     throw new TypeError(`Expected String but got ${getType(str)}.`);
@@ -1639,21 +1646,6 @@ var escapeURLEncodedHTMLChars = (ch) => {
   }
   return escapedChar;
 };
-var unescapeURLEncodedHTMLChars = (ch) => {
-  let unescapedChar;
-  if (/%26lt;?/.test(ch)) {
-    unescapedChar = "<";
-  } else if (/%26gt;?/.test(ch)) {
-    unescapedChar = ">";
-  } else if (/%26quot;?/.test(ch)) {
-    unescapedChar = '"';
-  } else if (/%26%2339;?/.test(ch)) {
-    unescapedChar = "'";
-  } else {
-    unescapedChar = ch;
-  }
-  return unescapedChar;
-};
 var parseBase64 = (data) => {
   if (!isString(data)) {
     throw new TypeError(`Expected String but got ${getType(data)}.`);
@@ -1687,9 +1679,9 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
     for (const item of items) {
       const [numCharRef, value] = item;
       let num;
-      if (/^x[\dA-F]+/i.test(value)) {
+      if (REG_NUM_HEX.test(value)) {
         num = parseInt(`0${value}`, HEX);
-      } else if (/^[\d]+/.test(value)) {
+      } else if (REG_NUM_DECI.test(value)) {
         num = parseInt(value);
       }
       if (Number.isInteger(num)) {
@@ -1700,7 +1692,7 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
         ];
         if (textCharCodes.has(num)) {
           res = `${preNum}${String.fromCharCode(num)}${postNum}`;
-          if (/#x?$/.test(preNum) || /^#(?:x(?:00)?[2-7]|\d)/.test(postNum)) {
+          if (REG_NUM_HEAD.test(preNum) || REG_NUM_HEAD_ASCII.test(postNum)) {
             res = parseURLEncodedNumCharRef(res, ++nest);
           }
         } else if (num < HEX * HEX) {
@@ -1711,12 +1703,6 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
   }
   return res;
 };
-var purifyURLEncodedDOM = (dom) => {
-  if (!isString(dom)) {
-    throw new TypeError(`Expected String but got ${getType(dom)}.`);
-  }
-  return encodeURIComponent(import_dompurify.default.sanitize(decodeURIComponent(dom)));
-};
 var URISchemes = class {
   /* private fields */
   #schemes;
@@ -1774,7 +1760,7 @@ var URISchemes = class {
   /**
    * verify URI
    *
-   * @param {string} uri - URI input
+   * @param {string} uri - URI
    * @returns {boolean} - result
    */
   verify(uri) {
@@ -1782,7 +1768,7 @@ var URISchemes = class {
     if (isString(uri)) {
       try {
         const { protocol } = new URL(uri);
-        const scheme = protocol.replace(/:$/, "");
+        const scheme = protocol.replace(REG_END_COLON, "");
         const schemeParts = scheme.split("+");
         res = !REG_SCRIPT.test(scheme) && REG_SCHEME_CUSTOM.test(scheme) || schemeParts.every((s) => this.#schemes.has(s));
       } catch (e) {
@@ -1804,17 +1790,72 @@ var URLSanitizer = class extends URISchemes {
     this.#nest = 0;
     this.#recurse = /* @__PURE__ */ new Set();
   }
+  /**
+   * replace matched data URLs
+   *
+   * @param {string} data - data URL
+   * @returns {string} - replaced data URL
+   */
+  replace(data) {
+    if (!isString(data)) {
+      throw new TypeError(`Expected String but got ${getType(data)}.`);
+    }
+    let replacedData = data;
+    if (REG_DATA_URL.test(replacedData)) {
+      const matchedDataUrls = replacedData.matchAll(REG_DATA_URL_G);
+      const items = [...matchedDataUrls].reverse();
+      for (const item of items) {
+        let [dataUrl] = item;
+        if (REG_DATA_URL_BASE64.test(dataUrl)) {
+          [dataUrl] = REG_DATA_URL_BASE64.exec(dataUrl);
+        }
+        this.#nest++;
+        this.#recurse.add(dataUrl);
+        const parsedDataUrl = this.sanitize(dataUrl, {
+          allow: ["data"]
+        });
+        const { index } = item;
+        const [preDataUrl, postDataUrl] = [
+          replacedData.substring(0, index),
+          replacedData.substring(index + dataUrl.length)
+        ];
+        if (parsedDataUrl) {
+          replacedData = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
+        } else {
+          replacedData = `${preDataUrl}${postDataUrl}`;
+        }
+      }
+    }
+    return replacedData;
+  }
+  /**
+   * purify URL encoded DOM
+   *
+   * @param {string} dom - DOM string
+   * @returns {string} - purified DOM string
+   */
+  purify(dom) {
+    if (!isString(dom)) {
+      throw new TypeError(`Expected String but got ${getType(dom)}.`);
+    }
+    let purifiedDom = import_dompurify.default.sanitize(decodeURIComponent(dom));
+    if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {
+      purifiedDom = this.replace(purifiedDom);
+    }
+    purifiedDom = purifiedDom.replace(REG_END_NUM, "").replace(REG_END_QUEST, "");
+    return encodeURI(purifiedDom);
+  }
   /**
    * sanitize URL
-   * NOTE: `data` and/or `file` schemes must be explicitly allowed
-   *       `javascript` and/or `vbscript` schemes can not be allowed
+   * NOTE: `blob`, `data` and `file` schemes must be explicitly allowed
+   *       `javascript` and `vbscript` schemes can not be allowed
    *
-   * @param {string} url - URL input
+   * @param {string} url - URL
    * @param {object} opt - options
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
    * @param {Array.<string>} opt.only - array of specific schemes to allow
-   * @param {boolean} opt.truncate - truncate tag and/or quote and the rest
+   * @param {boolean} opt.remove - remove tag and/or quote and the rest
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt = { allow: [], deny: [], only: [] }) {
@@ -1822,8 +1863,9 @@ var URLSanitizer = class extends URISchemes {
       this.#nest = 0;
       throw new Error("Data URLs nested too deeply.");
     }
-    const { allow, deny, only, truncate } = opt ?? {};
+    const { allow, deny, only, remove } = opt ?? {};
     const schemeMap = /* @__PURE__ */ new Map([
+      ["blob", false],
       ["data", false],
       ["file", false],
       ["javascrpt", false],
@@ -1894,7 +1936,7 @@ var URLSanitizer = class extends URISchemes {
     let sanitizedUrl;
     if (super.verify(url)) {
       const { hash, href, pathname, protocol, search } = new URL(url);
-      const scheme = protocol.replace(/:$/, "");
+      const scheme = protocol.replace(REG_END_COLON, "");
       const schemeParts = scheme.split("+");
       let bool;
       if (restrictScheme) {
@@ -1908,79 +1950,66 @@ var URLSanitizer = class extends URISchemes {
         }
       }
       if (bool) {
-        let escapeHtml;
+        const isDataUrl = schemeParts.includes("data");
+        let finalize;
         let urlToSanitize = href;
-        if (schemeParts.includes("data")) {
+        if (isDataUrl) {
           const [head, ...body] = pathname.split(",");
           const data = `${body.join(",")}${search}${hash}`;
           const mediaType = head.split(";");
+          const isBase64 = mediaType[mediaType.length - 1] === "base64";
           let parsedData = data;
-          if (mediaType[mediaType.length - 1] === "base64") {
-            mediaType.pop();
+          if (isBase64) {
             parsedData = parseBase64(data);
-          } else {
-            try {
-              const decodedData = parseURLEncodedNumCharRef(parsedData);
-              const { protocol: dataScheme } = new URL(decodedData.trim());
-              const dataSchemeParts = dataScheme.replace(/:$/, "").split("+");
-              if (dataSchemeParts.some((s) => REG_SCRIPT.test(s))) {
-                urlToSanitize = "";
-              }
-            } catch (e) {
+          }
+          try {
+            const decodedData = parseURLEncodedNumCharRef(parsedData);
+            const { protocol: dataScheme } = new URL(decodedData.trim());
+            const dataSchemeParts = dataScheme.replace(REG_END_COLON, "").split("+");
+            if (dataSchemeParts.some((s) => REG_SCRIPT.test(s))) {
+              urlToSanitize = "";
             }
+          } catch (e) {
           }
-          const containsDataUrl = /data:[^,]*,/.test(parsedData);
+          const containsDataUrl = REG_DATA_URL.test(parsedData);
           if (parsedData !== data || containsDataUrl) {
             if (containsDataUrl) {
-              const matchedDataUrls = parsedData.matchAll(REG_DATA_URL);
-              const items = [...matchedDataUrls].reverse();
-              for (const item of items) {
-                let [dataUrl] = item;
-                if (REG_DATA_URL_BASE64.test(dataUrl)) {
-                  [dataUrl] = REG_DATA_URL_BASE64.exec(dataUrl);
-                }
-                this.#nest++;
-                this.#recurse.add(dataUrl);
-                const parsedDataUrl = this.sanitize(dataUrl, {
-                  allow: ["data"]
-                });
-                if (parsedDataUrl) {
-                  const { index } = item;
-                  const [preDataUrl, postDataUrl] = [
-                    parsedData.substring(0, index),
-                    parsedData.substring(index + dataUrl.length)
-                  ];
-                  parsedData = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
-                }
-              }
-              if (this.#recurse.has(url)) {
-                this.#recurse.delete(url);
-              } else {
-                escapeHtml = true;
-              }
+              parsedData = this.replace(parsedData);
             } else if (this.#recurse.has(url)) {
               this.#recurse.delete(url);
             } else {
-              escapeHtml = true;
+              finalize = true;
             }
-            urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
           } else if (this.#recurse.has(url)) {
             this.#recurse.delete(url);
           } else {
-            escapeHtml = true;
+            finalize = true;
+          }
+          if (!head || REG_MIME_DOM.test(head)) {
+            parsedData = this.purify(parsedData);
+          }
+          if (urlToSanitize && parsedData) {
+            if (isBase64 && parsedData !== data) {
+              mediaType.pop();
+            }
+            urlToSanitize = `${scheme}:${mediaType.join(";")},${parsedData}`;
+          } else {
+            urlToSanitize = "";
           }
         } else {
-          escapeHtml = true;
+          finalize = true;
         }
-        if (!schemeParts.includes("data") && truncate && REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
-          const item = REG_HTML_SP_URL_ENC_SHORT.exec(urlToSanitize);
+        if (!isDataUrl && remove && REG_HTML_URL_ENC_SHORT.test(urlToSanitize)) {
+          const item = REG_HTML_URL_ENC_SHORT.exec(urlToSanitize);
           const { index } = item;
           urlToSanitize = urlToSanitize.substring(0, index);
         }
         if (urlToSanitize) {
           sanitizedUrl = urlToSanitize.replace(REG_HTML_SP, getURLEncodedString).replace(REG_URL_ENC_AMP, escapeURLEncodedHTMLChars);
-          if (escapeHtml) {
-            sanitizedUrl = sanitizedUrl.replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
+          if (finalize) {
+            if (!isDataUrl) {
+              sanitizedUrl = sanitizedUrl.replace(REG_HTML_URL_ENC, escapeURLEncodedHTMLChars);
+            }
             this.#nest = 0;
           }
         } else {
@@ -1999,7 +2028,7 @@ var URLSanitizer = class extends URISchemes {
    * @property {boolean} valid - is valid URI
    * @property {object} data - parsed result of data URL, `null`able
    * @property {string} data.mime - MIME type
-   * @property {boolean} data.base64 - `true` if base64 encoded
+   * @property {boolean} data.base64 - is base64 encoded
    * @property {string} data.data - data part of the data URL
    * @property {string} href - sanitized URL input
    * @property {string} origin - scheme, domain and port of the sanitized URL
@@ -2011,13 +2040,12 @@ var URLSanitizer = class extends URISchemes {
    * @property {string} port - port number of the sanitized URL
    * @property {string} pathname - path of the sanitized URL
    * @property {string} search - query string of the sanitized URL
-   * @property {object} searchParams - URLSearchParams object
    * @property {string} hash - fragment identifier of the sanitized URL
    */
   /**
    * parse sanitized URL
    *
-   * @param {string} url - URL input
+   * @param {string} url - URL
    * @param {object} opt - options
    * @returns {ParsedURL} - result with enhanced props based on URL API
    */
@@ -2026,7 +2054,7 @@ var URLSanitizer = class extends URISchemes {
       throw new TypeError(`Expected String but got ${getType(url)}.`);
     }
     const sanitizedUrl = this.sanitize(url, opt ?? {
-      allow: ["data", "file"]
+      allow: ["blob", "data", "file"]
     });
     const parsedUrl = /* @__PURE__ */ new Map([
       ["input", url]
@@ -2034,9 +2062,10 @@ var URLSanitizer = class extends URISchemes {
     if (sanitizedUrl) {
       const urlObj = new URL(sanitizedUrl);
       const { pathname, protocol } = urlObj;
-      const schemeParts = protocol.replace(/:$/, "").split("+");
+      const schemeParts = protocol.replace(REG_END_COLON, "").split("+");
+      const isDataUrl = schemeParts.includes("data");
       parsedUrl.set("valid", true);
-      if (schemeParts.includes("data")) {
+      if (isDataUrl) {
         const dataUrl = /* @__PURE__ */ new Map();
         const [head, ...body] = pathname.split(",");
         const data = `${body.join(",")}`;
@@ -2047,51 +2076,15 @@ var URLSanitizer = class extends URISchemes {
         }
         dataUrl.set("mime", mediaType.join(";"));
         dataUrl.set("base64", isBase64);
-        let purifiedDom;
-        if (!isBase64 && REG_MIME_DOM.test(head)) {
-          let parsedData = data;
-          const matchedHtmlChars = parsedData.matchAll(REG_URL_ENC_HTML_SP);
-          const items = [...matchedHtmlChars].reverse();
-          for (const item of items) {
-            const [htmlChar] = item;
-            const { index } = item;
-            const [preHtmlChar, postHtmlChar] = [
-              parsedData.substring(0, index),
-              parsedData.substring(index + htmlChar.length)
-            ];
-            const unescapedHtmlChar = unescapeURLEncodedHTMLChars(htmlChar);
-            parsedData = `${preHtmlChar}${unescapedHtmlChar}${postHtmlChar}`;
-          }
-          purifiedDom = purifyURLEncodedDOM(parsedData);
-          dataUrl.set("data", purifiedDom);
-        } else {
-          dataUrl.set("data", data);
-        }
+        dataUrl.set("data", data);
         parsedUrl.set("data", Object.fromEntries(dataUrl));
-        for (const key in urlObj) {
-          let value = urlObj[key];
-          if (isString(value)) {
-            if (isString(purifiedDom)) {
-              switch (key) {
-                case "href":
-                  value = `${protocol}${mediaType.join(";")},${purifiedDom}`;
-                  break;
-                case "pathname":
-                  value = `${mediaType.join(";")},${purifiedDom}`;
-                  break;
-                default:
-              }
-            }
-            parsedUrl.set(key, value);
-          }
-        }
       } else {
         parsedUrl.set("data", null);
-        for (const key in urlObj) {
-          const value = urlObj[key];
-          if (isString(value)) {
-            parsedUrl.set(key, value);
-          }
+      }
+      for (const key in urlObj) {
+        const value = urlObj[key];
+        if (isString(value)) {
+          parsedUrl.set(key, value);
         }
       }
     } else {
@@ -2111,19 +2104,11 @@ var parseURL = async (url) => {
   const res = await parseURLSync(url);
   return res;
 };
-var sanitizeURLSync = (url, opt) => {
-  const parsedUrl = urlSanitizer.parse(url, opt ?? {
-    allow: [],
-    deny: [],
-    only: []
-  });
-  let res;
-  if (parsedUrl) {
-    const { href } = parsedUrl;
-    res = href;
-  }
-  return res ?? null;
-};
+var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
+  allow: [],
+  deny: [],
+  only: []
+});
 var sanitizeURL = async (url, opt) => {
   const res = await sanitizeURLSync(url, opt);
   return res;