url-sanitizer 0.7.4 → 0.7.6

package/README.md

@@ -36,6 +36,8 @@ import urlSanitizer, {
 
 Sanitize the given URL.
 * `data` and `file` schemes must be explicitly allowed.
+* `blob` URLs are not currently allowed and will return `null`.
+  See [Figure out how to sanitize the blob URL · Issue #4](https://github.com/asamuzaK/urlSanitizer/issues/4)
 
 ### Parameters
 
@@ -61,7 +63,7 @@ console.log(decodeURIComponent(res1));
 const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
   allow: ['data']
 })
-// -> 'data:text/html,%3Cdiv%3E%3C%2Fdiv%3E%3Cp%3E%3C%2Fp%3E'
+// => 'data:text/html,%3Cdiv%3E%3C/div%3E%3Cp%3E%3C/p%3E'
 
 console.log(decodeURIComponent(res2));
 // => 'data:text/html,<div></div><p></p>'
@@ -71,14 +73,14 @@ const base64data3 = btoa('<div><script>alert(1);</script></div>');
 const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
   allow: ['data']
 })
-// => 'data:text/html,%3Cdiv%3E%3C%2Fdiv%3E'
+// => 'data:text/html,%3Cdiv%3E%3C/div%3E'
 
 console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div>'
 
 const base64data4 = btoa('<div><img src="javascript:alert(1)"></div>');
 const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
-// => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C%2Fdiv%3E'
+// => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C/div%3E'
 
 console.log(decodeURIComponent(res4));
 // => 'data:text/html,<div><img></div>'
@@ -152,7 +154,7 @@ Type: [object][3]
 * `valid` **[boolean][2]** Is valid URI.
 * `data` **[object][3]** Parsed result of data URL, `null`able.
   * `data.mime` **[string][1]** MIME type.
-  * `data.base64` **[boolean][2]** `true` if base64 encoded.
+  * `data.base64` **[boolean][2]** Is base64 encoded.
   * `data.data` **[string][1]** Data part of the data URL.
 * `href` **[string][1]** Sanitized URL input.
 * `origin` **[string][1]** Scheme, domain and port of the sanitized URL.
@@ -196,12 +198,12 @@ const res3 = await parseURL('data:image/svg+xml;base64,PHN2Zz48ZyBvbmNsaWNrPSJhb
         data: {
           mime: 'image/svg+xml',
           base64: false,
-          data: '%3Csvg%3E%3Cg%3E%3C%2Fg%3E%3C%2Fsvg%3E'
+          data: '%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E'
         },
-        href: 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C%2Fg%3E%3C%2Fsvg%3E',
+        href: 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E',
         origin: 'null',
         protocol: 'data:',
-        pathname: 'image/svg+xml,%3Csvg%3E%3Cg%3E%3C%2Fg%3E%3C%2Fsvg%3E',
+        pathname: 'image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E',
         ...
       } */
 
@@ -231,7 +233,7 @@ Synchronous version of the [parseURL()](#parseURL).
 
 ## isURI(uri)
 
-Verify if the given URI is valid.
+Verify if the given URI is valid and registered.
 
 ### Parameters
 
@@ -239,6 +241,7 @@ Verify if the given URI is valid.
 
 Returns **[Promise][5]<[boolean][2]>** Result.
 * Always `true` for `web+*` and `ext+*` schemes, except `web+javascript`, `web+vbscript`, `ext+javascript`, `ext+vbscript`.
+* `false` for `javascript` and `vbscript` schemes.
 
 ```javascript
 const res1 = await isURI('https://example.com/foo');

package/dist/url-sanitizer.js

@@ -1595,16 +1595,25 @@ var uri_schemes_default = [
 // bundle/mjs/uri-util.js
 var HEX = 16;
 var REG_BASE64 = /^[\da-z+/\-_=]+$/i;
-var REG_DATA_URL = /data:[^,]*,[^"]+/g;
+var REG_DATA_URL = /data:[^,]*,/;
 var REG_DATA_URL_BASE64 = /data:[^,]*;?base64,[\da-z+/\-_=]+/i;
+var REG_DATA_URL_G = /data:[^,]*,[^"]+/g;
+var REG_END_COLON = /:$/;
+var REG_END_NUM = /(?:#|%23)$/;
+var REG_END_QUEST = /(?<!(?:#|%23).*)(?:\?|%3F)$/;
 var REG_HTML_SP = /[<>"'\s]/g;
-var REG_HTML_SP_URL_ENC = /%(?:2(?:2|7)|3(?:C|E))/g;
-var REG_HTML_SP_URL_ENC_SHORT = /%(?:2(?:2|7)|3(?:C|E))+?/;
+var REG_HTML_URL_ENC = /%(?:2(?:2|7)|3(?:C|E))/g;
+var REG_HTML_URL_ENC_SHORT = /%(?:2(?:2|7)|3(?:C|E))+?/;
 var REG_MIME_DOM = /^(?:text\/(?:ht|x)ml|application\/(?:xhtml\+)?xml|image\/svg\+xml)/;
+var REG_NUM_DECI = /^\d+/;
+var REG_NUM_HEAD = /#x?$/;
+var REG_NUM_HEAD_ASCII = /^#(?:x(?:00)?[2-7]|\d)/;
+var REG_NUM_HEX = /^x[\dA-F]+/i;
 var REG_NUM_REF = /&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/ig;
 var REG_SCHEME = /^[a-z][\da-z+\-.]*$/;
 var REG_SCHEME_CUSTOM = /^(?:ext|web)\+[a-z]+$/;
 var REG_SCRIPT = /(?:java|vb)script/;
+var REG_SCRIPT_BLOB = /(?:java|vb)script|blob/;
 var REG_URL_ENC = /^%[\dA-F]{2}$/i;
 var REG_URL_ENC_AMP = /%26/g;
 var getURLEncodedString = (str) => {
@@ -1671,9 +1680,9 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
     for (const item of items) {
       const [numCharRef, value] = item;
       let num;
-      if (/^x[\dA-F]+/i.test(value)) {
+      if (REG_NUM_HEX.test(value)) {
         num = parseInt(`0${value}`, HEX);
-      } else if (/^[\d]+/.test(value)) {
+      } else if (REG_NUM_DECI.test(value)) {
         num = parseInt(value);
       }
       if (Number.isInteger(num)) {
@@ -1684,7 +1693,7 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
         ];
         if (textCharCodes.has(num)) {
           res = `${preNum}${String.fromCharCode(num)}${postNum}`;
-          if (/#x?$/.test(preNum) || /^#(?:x(?:00)?[2-7]|\d)/.test(postNum)) {
+          if (REG_NUM_HEAD.test(preNum) || REG_NUM_HEAD_ASCII.test(postNum)) {
             res = parseURLEncodedNumCharRef(res, ++nest);
           }
         } else if (num < HEX * HEX) {
@@ -1752,7 +1761,7 @@ var URISchemes = class {
   /**
    * verify URI
    *
-   * @param {string} uri - URI input
+   * @param {string} uri - URI
    * @returns {boolean} - result
    */
   verify(uri) {
@@ -1760,7 +1769,7 @@ var URISchemes = class {
     if (isString(uri)) {
       try {
         const { protocol } = new URL(uri);
-        const scheme = protocol.replace(/:$/, "");
+        const scheme = protocol.replace(REG_END_COLON, "");
         const schemeParts = scheme.split("+");
         res = !REG_SCRIPT.test(scheme) && REG_SCHEME_CUSTOM.test(scheme) || schemeParts.every((s) => this.#schemes.has(s));
       } catch (e) {
@@ -1783,18 +1792,18 @@ var URLSanitizer = class extends URISchemes {
     this.#recurse = /* @__PURE__ */ new Set();
   }
   /**
-   * purify URL encoded DOM
+   * replace matched data URLs
    *
-   * @param {string} dom - DOM input
-   * @returns {string} - purified DOM
+   * @param {string} data - data URL
+   * @returns {string} - replaced data URL
    */
-  purify(dom) {
-    if (!isString(dom)) {
-      throw new TypeError(`Expected String but got ${getType(dom)}.`);
+  replace(data) {
+    if (!isString(data)) {
+      throw new TypeError(`Expected String but got ${getType(data)}.`);
     }
-    let purifiedDom = import_dompurify.default.sanitize(decodeURIComponent(dom));
-    if (purifiedDom) {
-      const matchedDataUrls = purifiedDom.matchAll(REG_DATA_URL);
+    let replacedData = data;
+    if (REG_DATA_URL.test(replacedData)) {
+      const matchedDataUrls = replacedData.matchAll(REG_DATA_URL_G);
       const items = [...matchedDataUrls].reverse();
       for (const item of items) {
         let [dataUrl] = item;
@@ -1808,24 +1817,41 @@ var URLSanitizer = class extends URISchemes {
         });
         const { index } = item;
         const [preDataUrl, postDataUrl] = [
-          purifiedDom.substring(0, index),
-          purifiedDom.substring(index + dataUrl.length)
+          replacedData.substring(0, index),
+          replacedData.substring(index + dataUrl.length)
         ];
         if (parsedDataUrl) {
-          purifiedDom = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
+          replacedData = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
         } else {
-          purifiedDom = `${preDataUrl}${postDataUrl}`;
+          replacedData = `${preDataUrl}${postDataUrl}`;
         }
       }
     }
-    return encodeURIComponent(purifiedDom);
+    return replacedData;
+  }
+  /**
+   * purify URL encoded DOM
+   *
+   * @param {string} dom - DOM string
+   * @returns {string} - purified DOM string
+   */
+  purify(dom) {
+    if (!isString(dom)) {
+      throw new TypeError(`Expected String but got ${getType(dom)}.`);
+    }
+    let purifiedDom = import_dompurify.default.sanitize(decodeURIComponent(dom));
+    if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {
+      purifiedDom = this.replace(purifiedDom);
+    }
+    purifiedDom = purifiedDom.replace(REG_END_NUM, "").replace(REG_END_QUEST, "");
+    return encodeURI(purifiedDom);
   }
   /**
    * sanitize URL
-   * NOTE: `data` and/or `file` schemes must be explicitly allowed
-   *       `javascript` and/or `vbscript` schemes can not be allowed
+   * NOTE: `blob`, `data` and `file` schemes must be explicitly allowed
+   *       `javascript` and `vbscript` schemes can not be allowed
    *
-   * @param {string} url - URL input
+   * @param {string} url - URL
    * @param {object} opt - options
    * @param {Array.<string>} opt.allow - array of allowed schemes
    * @param {Array.<string>} opt.deny - array of denied schemes
@@ -1840,6 +1866,7 @@ var URLSanitizer = class extends URISchemes {
     }
     const { allow, deny, only, remove } = opt ?? {};
     const schemeMap = /* @__PURE__ */ new Map([
+      ["blob", false],
       ["data", false],
       ["file", false],
       ["javascrpt", false],
@@ -1855,7 +1882,7 @@ var URLSanitizer = class extends URISchemes {
       for (let item of items) {
         if (isString(item)) {
           item = item.trim();
-          if (!REG_SCRIPT.test(item)) {
+          if (!REG_SCRIPT_BLOB.test(item)) {
             if (super.has(item)) {
               schemeMap.set(item, true);
             } else {
@@ -1879,7 +1906,7 @@ var URLSanitizer = class extends URISchemes {
         for (let item of items) {
           if (isString(item)) {
             item = item.trim();
-            if (!REG_SCRIPT.test(item)) {
+            if (!REG_SCRIPT_BLOB.test(item)) {
               if (super.has(item)) {
                 schemeMap.set(item, true);
               } else {
@@ -1910,7 +1937,7 @@ var URLSanitizer = class extends URISchemes {
     let sanitizedUrl;
     if (super.verify(url)) {
       const { hash, href, pathname, protocol, search } = new URL(url);
-      const scheme = protocol.replace(/:$/, "");
+      const scheme = protocol.replace(REG_END_COLON, "");
       const schemeParts = scheme.split("+");
       let bool;
       if (restrictScheme) {
@@ -1924,9 +1951,10 @@ var URLSanitizer = class extends URISchemes {
         }
       }
       if (bool) {
-        let escapeHtml;
+        const isDataUrl = schemeParts.includes("data");
+        let finalize;
         let urlToSanitize = href;
-        if (schemeParts.includes("data")) {
+        if (isDataUrl) {
           const [head, ...body] = pathname.split(",");
           const data = `${body.join(",")}${search}${hash}`;
           const mediaType = head.split(";");
@@ -1934,58 +1962,32 @@ var URLSanitizer = class extends URISchemes {
           let parsedData = data;
           if (isBase64) {
             parsedData = parseBase64(data);
-          } else {
-            try {
-              const decodedData = parseURLEncodedNumCharRef(parsedData);
-              const { protocol: dataScheme } = new URL(decodedData.trim());
-              const dataSchemeParts = dataScheme.replace(/:$/, "").split("+");
-              if (dataSchemeParts.some((s) => REG_SCRIPT.test(s))) {
-                urlToSanitize = "";
-              }
-            } catch (e) {
+          }
+          try {
+            const decodedData = parseURLEncodedNumCharRef(parsedData);
+            const { protocol: dataScheme } = new URL(decodedData.trim());
+            const dataSchemeParts = dataScheme.replace(REG_END_COLON, "").split("+");
+            if (dataSchemeParts.some((s) => REG_SCRIPT_BLOB.test(s))) {
+              urlToSanitize = "";
             }
+          } catch (e) {
           }
-          const containsDataUrl = /data:[^,]*,/.test(parsedData);
+          const containsDataUrl = REG_DATA_URL.test(parsedData);
           if (parsedData !== data || containsDataUrl) {
             if (containsDataUrl) {
-              const matchedDataUrls = parsedData.matchAll(REG_DATA_URL);
-              const items = [...matchedDataUrls].reverse();
-              for (const item of items) {
-                let [dataUrl] = item;
-                if (REG_DATA_URL_BASE64.test(dataUrl)) {
-                  [dataUrl] = REG_DATA_URL_BASE64.exec(dataUrl);
-                }
-                this.#nest++;
-                this.#recurse.add(dataUrl);
-                const parsedDataUrl = this.sanitize(dataUrl, {
-                  allow: ["data"]
-                });
-                if (parsedDataUrl) {
-                  const { index } = item;
-                  const [preDataUrl, postDataUrl] = [
-                    parsedData.substring(0, index),
-                    parsedData.substring(index + dataUrl.length)
-                  ];
-                  parsedData = `${preDataUrl}${parsedDataUrl}${postDataUrl}`;
-                }
-              }
-              if (this.#recurse.has(url)) {
-                this.#recurse.delete(url);
-              } else {
-                escapeHtml = true;
-              }
+              parsedData = this.replace(parsedData);
             } else if (this.#recurse.has(url)) {
               this.#recurse.delete(url);
             } else {
-              escapeHtml = true;
+              finalize = true;
             }
           } else if (this.#recurse.has(url)) {
             this.#recurse.delete(url);
           } else {
-            escapeHtml = true;
+            finalize = true;
           }
-          if (REG_MIME_DOM.test(head)) {
-            parsedData = this.purify(parsedData).replace(/%23$/, "").replace(/%3F$/, "");
+          if (!head || REG_MIME_DOM.test(head)) {
+            parsedData = this.purify(parsedData);
           }
           if (urlToSanitize && parsedData) {
             if (isBase64 && parsedData !== data) {
@@ -1996,18 +1998,18 @@ var URLSanitizer = class extends URISchemes {
             urlToSanitize = "";
           }
         } else {
-          escapeHtml = true;
+          finalize = true;
         }
-        if (!schemeParts.includes("data") && remove && REG_HTML_SP_URL_ENC_SHORT.test(urlToSanitize)) {
-          const item = REG_HTML_SP_URL_ENC_SHORT.exec(urlToSanitize);
+        if (!isDataUrl && remove && REG_HTML_URL_ENC_SHORT.test(urlToSanitize)) {
+          const item = REG_HTML_URL_ENC_SHORT.exec(urlToSanitize);
           const { index } = item;
           urlToSanitize = urlToSanitize.substring(0, index);
         }
         if (urlToSanitize) {
           sanitizedUrl = urlToSanitize.replace(REG_HTML_SP, getURLEncodedString).replace(REG_URL_ENC_AMP, escapeURLEncodedHTMLChars);
-          if (escapeHtml) {
-            if (!schemeParts.includes("data")) {
-              sanitizedUrl = sanitizedUrl.replace(REG_HTML_SP_URL_ENC, escapeURLEncodedHTMLChars);
+          if (finalize) {
+            if (!isDataUrl) {
+              sanitizedUrl = sanitizedUrl.replace(REG_HTML_URL_ENC, escapeURLEncodedHTMLChars);
             }
             this.#nest = 0;
           }
@@ -2027,7 +2029,7 @@ var URLSanitizer = class extends URISchemes {
    * @property {boolean} valid - is valid URI
    * @property {object} data - parsed result of data URL, `null`able
    * @property {string} data.mime - MIME type
-   * @property {boolean} data.base64 - `true` if base64 encoded
+   * @property {boolean} data.base64 - is base64 encoded
    * @property {string} data.data - data part of the data URL
    * @property {string} href - sanitized URL input
    * @property {string} origin - scheme, domain and port of the sanitized URL
@@ -2039,22 +2041,21 @@ var URLSanitizer = class extends URISchemes {
    * @property {string} port - port number of the sanitized URL
    * @property {string} pathname - path of the sanitized URL
    * @property {string} search - query string of the sanitized URL
-   * @property {object} searchParams - URLSearchParams object
    * @property {string} hash - fragment identifier of the sanitized URL
    */
   /**
    * parse sanitized URL
    *
-   * @param {string} url - URL input
+   * @param {string} url - URL
    * @param {object} opt - options
-   * @returns {ParsedURL} - result with enhanced props based on URL API
+   * @returns {ParsedURL} - result with additional props based on URL API
    */
   parse(url, opt) {
     if (!isString(url)) {
       throw new TypeError(`Expected String but got ${getType(url)}.`);
     }
     const sanitizedUrl = this.sanitize(url, opt ?? {
-      allow: ["data", "file"]
+      allow: ["blob", "data", "file"]
     });
     const parsedUrl = /* @__PURE__ */ new Map([
       ["input", url]
@@ -2062,9 +2063,10 @@ var URLSanitizer = class extends URISchemes {
     if (sanitizedUrl) {
       const urlObj = new URL(sanitizedUrl);
       const { pathname, protocol } = urlObj;
-      const schemeParts = protocol.replace(/:$/, "").split("+");
+      const schemeParts = protocol.replace(REG_END_COLON, "").split("+");
+      const isDataUrl = schemeParts.includes("data");
       parsedUrl.set("valid", true);
-      if (schemeParts.includes("data")) {
+      if (isDataUrl) {
         const dataUrl = /* @__PURE__ */ new Map();
         const [head, ...body] = pathname.split(",");
         const data = `${body.join(",")}`;
@@ -2103,19 +2105,11 @@ var parseURL = async (url) => {
   const res = await parseURLSync(url);
   return res;
 };
-var sanitizeURLSync = (url, opt) => {
-  const parsedUrl = urlSanitizer.parse(url, opt ?? {
-    allow: [],
-    deny: [],
-    only: []
-  });
-  let res;
-  if (parsedUrl) {
-    const { href } = parsedUrl;
-    res = href;
-  }
-  return res ?? null;
-};
+var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
+  allow: [],
+  deny: [],
+  only: []
+});
 var sanitizeURL = async (url, opt) => {
   const res = await sanitizeURLSync(url, opt);
   return res;