url-sanitizer 0.7.5 → 0.8.0

package/README.md

@@ -36,6 +36,7 @@ import urlSanitizer, {
 
 Sanitize the given URL.
 * `blob`, `data` and `file` schemes must be explicitly allowed.
+* Given a `blob` URL, returns a sanitized `data` URL.
 
 ### Parameters
 
@@ -57,16 +58,18 @@ const res1 = await sanitizeURL('http://example.com/"onmouseover="alert(1)"?<scri
 console.log(decodeURIComponent(res1));
 // => 'http://example.com/&quot;onmouseover=&quot;alert(1)&quot;?&lt;script&gt;alert(&#39;XSS&#39;);&lt;/script&gt;'
 
+
 // Parse and purify data URL
 const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
   allow: ['data']
 })
-// -> 'data:text/html,%3Cdiv%3E%3C/div%3E%3Cp%3E%3C/p%3E'
+// => 'data:text/html,%3Cdiv%3E%3C/div%3E%3Cp%3E%3C/p%3E'
 
 console.log(decodeURIComponent(res2));
 // => 'data:text/html,<div></div><p></p>'
 
-// Can also parse and purify base64 encoded data
+
+// Can parse and purify base64 encoded data
 const base64data3 = btoa('<div><script>alert(1);</script></div>');
 const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
   allow: ['data']
@@ -76,58 +79,79 @@ const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
 console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div>'
 
-const base64data4 = btoa('<div><img src="javascript:alert(1)"></div>');
-const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
+const base64data3_2 = btoa('<div><img src="javascript:alert(1)"></div>');
+const res3_2 = await sanitizeURL(`data:text/html;base64,${base64data3_2}`);
 // => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C/div%3E'
 
-console.log(decodeURIComponent(res4));
+console.log(decodeURIComponent(res3_2));
 // => 'data:text/html,<div><img></div>'
 
+
+// Can parse and sanitize blob URL
+const blob4 = new Blob(['<svg><g onload="alert(1)"/></svg>'], {
+  type: 'image/svg+xml'
+});
+const url4 = URL.createObjectURL(blob4);
+const res4 = await func(url, {
+ allow: ['blob']
+});
+// => 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E'
+
+console.log(decodeURIComponent(res4));
+// => 'data:image/svg+xml,<svg><g></g></svg>'
+
+
 // Deny if the scheme matches the `deny` list
 const res5 = await sanitizeURL('web+foo://example.com', {
   deny: ['web+foo']
 });
 // => null
 
+
 // Allow only if the scheme matches the `only` list
 const res6 = await sanitizeURL('http://example.com', {
   only: ['data', 'git', 'https']
 });
 // => null
 
-const res7 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
+const res6_2 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
   only: ['data', 'git', 'https']
 });
 // => 'https://example.com/%26quot;onmouseover=%26quot;alert(1)%26quot;'
 
-console.log(decodeURIComponent(res7));
+console.log(decodeURIComponent(res6_2));
 // => 'https://example.com/&quot;onmouseover=&quot;alert(1)&quot;'
 
+
 // `only` also allows combination of the schemes in the list
-const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
+const res7 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
   only: ['data', 'git', 'https']
 });
 // => 'git+https://example.com/foo.git?%26lt;script%26gt;alert(1)%26lt;/script%26gt;'
 
-console.log(decodeURIComponent(res8));
+console.log(decodeURIComponent(res7));
 // => 'git+https://example.com/foo.git?&lt;script&gt;alert(1)&lt;/script&gt;'
 
+
 // Remove the tag or quote and the rest of the URL following it.
-const res9 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
+const res8 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
   remove: true
 });
 // => 'https://example.com/'
 
-const res10 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
+const res8_2 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
   remove: true
 });
 // => 'https://example.com/?'
 ```
 
 
-## sanitizeURLSync
+## sanitizeURLSync(url, opt)
 
 Synchronous version of the [sanitizeURL()](#sanitizeurlurl-opt).
+* `data` and `file` schemes must be explicitly allowed.
+* `blob` scheme is not supported, returns `null`.
+  Use async [sanitizeURL()](#sanitizeurlurl-opt) for `blob`.
 
 
 ## parseURL(url)

package/dist/url-sanitizer.js

@@ -998,6 +998,10 @@ var require_purify = __commonJS({
   }
 });
 
+// bundle/mjs/file-reader.js
+var FileReader = window.FileReader;
+var fileReader = new FileReader();
+
 // bundle/mjs/common.js
 var TYPE_FROM = 8;
 var TYPE_TO = -1;
@@ -1613,6 +1617,7 @@ var REG_NUM_REF = /&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/ig;
 var REG_SCHEME = /^[a-z][\da-z+\-.]*$/;
 var REG_SCHEME_CUSTOM = /^(?:ext|web)\+[a-z]+$/;
 var REG_SCRIPT = /(?:java|vb)script/;
+var REG_SCRIPT_BLOB = /(?:java|vb)script|blob/;
 var REG_URL_ENC = /^%[\dA-F]{2}$/i;
 var REG_URL_ENC_AMP = /%26/g;
 var getURLEncodedString = (str) => {
@@ -1703,6 +1708,13 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
   }
   return res;
 };
+var createDataURLFromBlob = (blob) => new Promise((resolve, reject) => {
+  const reader = new FileReader();
+  reader.addEventListener("error", () => reject(reader.error));
+  reader.addEventListener("abort", () => resolve(reader.result));
+  reader.addEventListener("load", () => resolve(reader.result));
+  reader.readAsDataURL(blob);
+});
 var URISchemes = class {
   /* private fields */
   #schemes;
@@ -1847,7 +1859,8 @@ var URLSanitizer = class extends URISchemes {
   }
   /**
    * sanitize URL
-   * NOTE: `blob`, `data` and `file` schemes must be explicitly allowed
+   * NOTE: `data` and `file` schemes must be explicitly allowed
+   *       `blob` URLs should be converted to `data` URLs
    *       `javascript` and `vbscript` schemes can not be allowed
    *
    * @param {string} url - URL
@@ -1881,7 +1894,7 @@ var URLSanitizer = class extends URISchemes {
       for (let item of items) {
         if (isString(item)) {
           item = item.trim();
-          if (!REG_SCRIPT.test(item)) {
+          if (!REG_SCRIPT_BLOB.test(item)) {
             if (super.has(item)) {
               schemeMap.set(item, true);
             } else {
@@ -1905,7 +1918,7 @@ var URLSanitizer = class extends URISchemes {
         for (let item of items) {
           if (isString(item)) {
             item = item.trim();
-            if (!REG_SCRIPT.test(item)) {
+            if (!REG_SCRIPT_BLOB.test(item)) {
               if (super.has(item)) {
                 schemeMap.set(item, true);
               } else {
@@ -1966,7 +1979,7 @@ var URLSanitizer = class extends URISchemes {
             const decodedData = parseURLEncodedNumCharRef(parsedData);
             const { protocol: dataScheme } = new URL(decodedData.trim());
             const dataSchemeParts = dataScheme.replace(REG_END_COLON, "").split("+");
-            if (dataSchemeParts.some((s) => REG_SCRIPT.test(s))) {
+            if (dataSchemeParts.some((s) => REG_SCRIPT_BLOB.test(s))) {
               urlToSanitize = "";
             }
           } catch (e) {
@@ -2047,7 +2060,7 @@ var URLSanitizer = class extends URISchemes {
    *
    * @param {string} url - URL
    * @param {object} opt - options
-   * @returns {ParsedURL} - result with enhanced props based on URL API
+   * @returns {ParsedURL} - result with additional props based on URL API
    */
   parse(url, opt) {
     if (!isString(url)) {
@@ -2096,12 +2109,12 @@ var URLSanitizer = class extends URISchemes {
 var urlSanitizer = new URLSanitizer();
 var isURISync = (uri) => urlSanitizer.verify(uri);
 var isURI = async (uri) => {
-  const res = await isURISync(uri);
+  const res = urlSanitizer.verify(uri);
   return res;
 };
 var parseURLSync = (url) => urlSanitizer.parse(url);
 var parseURL = async (url) => {
-  const res = await parseURLSync(url);
+  const res = urlSanitizer.parse(url);
   return res;
 };
 var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
@@ -2109,9 +2122,39 @@ var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
   deny: [],
   only: []
 });
-var sanitizeURL = async (url, opt) => {
-  const res = await sanitizeURLSync(url, opt);
-  return res;
+var sanitizeURL = async (url, opt = {
+  allow: [],
+  deny: [],
+  only: []
+}) => {
+  const { protocol } = new URL(url);
+  let res;
+  if (protocol === "blob:") {
+    const { allow, deny, only } = opt;
+    if (Array.isArray(allow) && allow.includes("blob") && !(Array.isArray(deny) && deny.includes("blob")) || Array.isArray(only) && only.includes("blob")) {
+      const blob = await fetch(url).then((r) => r.blob());
+      const data = await createDataURLFromBlob(blob);
+      if (data) {
+        if (Array.isArray(only)) {
+          if (!only.includes("data")) {
+            only.push("data");
+          }
+        } else if (Array.isArray(allow)) {
+          if (!allow.includes("data")) {
+            allow.push("data");
+          }
+          if (Array.isArray(deny) && deny.includes("data")) {
+            const i = deny.indexOf("data");
+            deny.splice(i, 1);
+          }
+        }
+        res = urlSanitizer.sanitize(data, opt);
+      }
+    }
+  } else {
+    res = urlSanitizer.sanitize(url, opt);
+  }
+  return res || null;
 };
 export {
   urlSanitizer as default,