url-sanitizer 0.7.6 → 0.8.1

package/README.md

@@ -7,6 +7,8 @@
 [![license](https://img.shields.io/github/license/asamuzaK/urlSanitizer)](LICENSE)
 
 URL sanitizer for Node.js (>=18), browsers and web sites.
+Sanitize not only regular URLs, but also data URLs and blob URLs.
+Also ability to parse URLs and verify URIs.
 **Experimental**
 
 
@@ -35,9 +37,8 @@ import urlSanitizer, {
 ## sanitizeURL(url, opt)
 
 Sanitize the given URL.
-* `data` and `file` schemes must be explicitly allowed.
-* `blob` URLs are not currently allowed and will return `null`.
-  See [Figure out how to sanitize the blob URL · Issue #4](https://github.com/asamuzaK/urlSanitizer/issues/4)
+* `blob`, `data` and `file` schemes must be explicitly allowed.
+* Given a `blob` URL, returns a sanitized `data` URL.
 
 ### Parameters
 
@@ -59,6 +60,7 @@ const res1 = await sanitizeURL('http://example.com/"onmouseover="alert(1)"?<scri
 console.log(decodeURIComponent(res1));
 // => 'http://example.com/&quot;onmouseover=&quot;alert(1)&quot;?&lt;script&gt;alert(&#39;XSS&#39;);&lt;/script&gt;'
 
+
 // Parse and purify data URL
 const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
   allow: ['data']
@@ -68,7 +70,8 @@ const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></
 console.log(decodeURIComponent(res2));
 // => 'data:text/html,<div></div><p></p>'
 
-// Can also parse and purify base64 encoded data
+
+// Can parse and purify base64 encoded data
 const base64data3 = btoa('<div><script>alert(1);</script></div>');
 const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
   allow: ['data']
@@ -78,58 +81,79 @@ const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
 console.log(decodeURIComponent(res3));
 // => 'data:text/html,<div></div>'
 
-const base64data4 = btoa('<div><img src="javascript:alert(1)"></div>');
-const res4 = await sanitizeURL(`data:text/html;base64,${base64data4}`);
+const base64data3_2 = btoa('<div><img src="javascript:alert(1)"></div>');
+const res3_2 = await sanitizeURL(`data:text/html;base64,${base64data3_2}`);
 // => 'data:text/html,%3Cdiv%3E%3Cimg%3E%3C/div%3E'
 
-console.log(decodeURIComponent(res4));
+console.log(decodeURIComponent(res3_2));
 // => 'data:text/html,<div><img></div>'
 
+
+// Can parse and sanitize blob URL
+const blob4 = new Blob(['<svg><g onload="alert(1)"/></svg>'], {
+  type: 'image/svg+xml'
+});
+const url4 = URL.createObjectURL(blob4);
+const res4 = await func(url, {
+ allow: ['blob']
+});
+// => 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E'
+
+console.log(decodeURIComponent(res4));
+// => 'data:image/svg+xml,<svg><g></g></svg>'
+
+
 // Deny if the scheme matches the `deny` list
 const res5 = await sanitizeURL('web+foo://example.com', {
   deny: ['web+foo']
 });
 // => null
 
+
 // Allow only if the scheme matches the `only` list
 const res6 = await sanitizeURL('http://example.com', {
   only: ['data', 'git', 'https']
 });
 // => null
 
-const res7 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
+const res6_2 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"', {
   only: ['data', 'git', 'https']
 });
 // => 'https://example.com/%26quot;onmouseover=%26quot;alert(1)%26quot;'
 
-console.log(decodeURIComponent(res7));
+console.log(decodeURIComponent(res6_2));
 // => 'https://example.com/&quot;onmouseover=&quot;alert(1)&quot;'
 
+
 // `only` also allows combination of the schemes in the list
-const res8 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
+const res7 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
   only: ['data', 'git', 'https']
 });
 // => 'git+https://example.com/foo.git?%26lt;script%26gt;alert(1)%26lt;/script%26gt;'
 
-console.log(decodeURIComponent(res8));
+console.log(decodeURIComponent(res7));
 // => 'git+https://example.com/foo.git?&lt;script&gt;alert(1)&lt;/script&gt;'
 
+
 // Remove the tag or quote and the rest of the URL following it.
-const res9 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
+const res8 = await sanitizeURL('https://example.com/" onclick="alert(1)"', {
   remove: true
 });
 // => 'https://example.com/'
 
-const res10 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
+const res8_2 = await sanitizeURL('https://example.com/?<script>alert(1)</script>', {
   remove: true
 });
 // => 'https://example.com/?'
 ```
 
 
-## sanitizeURLSync
+## sanitizeURLSync(url, opt)
 
 Synchronous version of the [sanitizeURL()](#sanitizeurlurl-opt).
+* `data` and `file` schemes must be explicitly allowed.
+* `blob` scheme is not supported, returns `null`.
+  Use async [sanitizeURL()](#sanitizeurlurl-opt) for `blob`.
 
 
 ## parseURL(url)

package/dist/url-sanitizer.js

@@ -998,6 +998,10 @@ var require_purify = __commonJS({
   }
 });
 
+// bundle/mjs/file-reader.js
+var FileReader = window.FileReader;
+var fileReader = new FileReader();
+
 // bundle/mjs/common.js
 var TYPE_FROM = 8;
 var TYPE_TO = -1;
@@ -1704,6 +1708,13 @@ var parseURLEncodedNumCharRef = (str, nest = 0) => {
   }
   return res;
 };
+var createDataURLFromBlob = (blob) => new Promise((resolve, reject) => {
+  const reader = new FileReader();
+  reader.addEventListener("error", () => reject(reader.error));
+  reader.addEventListener("abort", () => resolve(reader.result));
+  reader.addEventListener("load", () => resolve(reader.result));
+  reader.readAsDataURL(blob);
+});
 var URISchemes = class {
   /* private fields */
   #schemes;
@@ -1848,7 +1859,8 @@ var URLSanitizer = class extends URISchemes {
   }
   /**
    * sanitize URL
-   * NOTE: `blob`, `data` and `file` schemes must be explicitly allowed
+   * NOTE: `data` and `file` schemes must be explicitly allowed
+   *       `blob` URLs should be converted to `data` URLs
    *       `javascript` and `vbscript` schemes can not be allowed
    *
    * @param {string} url - URL
@@ -2097,12 +2109,12 @@ var URLSanitizer = class extends URISchemes {
 var urlSanitizer = new URLSanitizer();
 var isURISync = (uri) => urlSanitizer.verify(uri);
 var isURI = async (uri) => {
-  const res = await isURISync(uri);
+  const res = urlSanitizer.verify(uri);
   return res;
 };
 var parseURLSync = (url) => urlSanitizer.parse(url);
 var parseURL = async (url) => {
-  const res = await parseURLSync(url);
+  const res = urlSanitizer.parse(url);
   return res;
 };
 var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
@@ -2110,9 +2122,43 @@ var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
   deny: [],
   only: []
 });
-var sanitizeURL = async (url, opt) => {
-  const res = await sanitizeURLSync(url, opt);
-  return res;
+var sanitizeURL = async (url, opt = {
+  allow: [],
+  deny: [],
+  only: []
+}) => {
+  const { protocol } = new URL(url);
+  let res;
+  if (protocol === "blob:") {
+    const { allow, deny, only } = opt;
+    if (Array.isArray(allow) && allow.includes("blob") && !(Array.isArray(deny) && deny.includes("blob")) || Array.isArray(only) && only.includes("blob")) {
+      let data;
+      try {
+        data = await fetch(url).then((r) => r.blob()).then(createDataURLFromBlob);
+        URL.revokeObjectURL(url);
+      } catch (e) {
+      }
+      if (data) {
+        if (Array.isArray(only)) {
+          if (!only.includes("data")) {
+            only.push("data");
+          }
+        } else if (Array.isArray(allow)) {
+          if (!allow.includes("data")) {
+            allow.push("data");
+          }
+          if (Array.isArray(deny) && deny.includes("data")) {
+            const i = deny.indexOf("data");
+            deny.splice(i, 1);
+          }
+        }
+        res = urlSanitizer.sanitize(data, opt);
+      }
+    }
+  } else {
+    res = urlSanitizer.sanitize(url, opt);
+  }
+  return res || null;
 };
 export {
   urlSanitizer as default,