url-sanitizer 0.8.1 → 0.8.4

package/README.md

@@ -8,7 +8,7 @@
 
 URL sanitizer for Node.js (>=18), browsers and web sites.
 Sanitize not only regular URLs, but also data URLs and blob URLs.
-Also ability to parse URLs and verify URIs.
+It also has the ability to parse URLs and verify URIs.
 **Experimental**
 
 
@@ -21,9 +21,14 @@ npm i url-sanitizer
 For browsers and web sites, standalone ESM builds are available in `dist/` directory.
 * node_modules/url-sanitizer/dist/url-sanitizer.js
 * node_modules/url-sanitizer/dist/url-sanitizer.min.js
+* node_modules/url-sanitizer/dist/url-sanitizer.wo.dompurify.js
+* node_modules/url-sanitizer/dist/url-sanitizer.wo.dompurify.min.js
 
 Or, download them from [Releases](https://github.com/asamuzaK/urlSanitizer/releases).
 
+NOTE: `url-sanitizer.wo.dompurify.js` and `url-sanitizer.wo.dompurify.min.js` are built without [DOMPurify](https://www.npmjs.com/package/dompurify).
+Use them if DOMPurify is exposed as `window.DOMPurify`.
+
 
 ## Usage
 
@@ -94,7 +99,7 @@ const blob4 = new Blob(['<svg><g onload="alert(1)"/></svg>'], {
   type: 'image/svg+xml'
 });
 const url4 = URL.createObjectURL(blob4);
-const res4 = await func(url, {
+const res4 = await func(url4, {
  allow: ['blob']
 });
 // => 'data:image/svg+xml,%3Csvg%3E%3Cg%3E%3C/g%3E%3C/svg%3E'
@@ -384,7 +389,7 @@ const res2 = urlSanitizer.remove('foo');
 
 The following resources have been of great help in the development of the URL Sanitizer.
 
-* [DOMPurify](https://www.npmjs.com/package/dompurify?activeTab=readme)
+* [DOMPurify](https://www.npmjs.com/package/dompurify)
 * [Uniform Resource Identifier (URI) Schemes - IANA](https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml)
 * [Encoding -- determine the character encoding of a text file. - file/file](https://github.com/file/file/blob/master/src/encoding.c)
 

package/dist/url-sanitizer.js

@@ -999,7 +999,7 @@ var require_purify = __commonJS({
 });
 
 // bundle/mjs/file-reader.js
-var FileReader = window.FileReader;
+var { FileReader } = window;
 var fileReader = new FileReader();
 
 // bundle/mjs/common.js
@@ -1976,8 +1976,8 @@ var URLSanitizer = class extends URISchemes {
             parsedData = parseBase64(data);
           }
           try {
-            const decodedData = parseURLEncodedNumCharRef(parsedData);
-            const { protocol: dataScheme } = new URL(decodedData.trim());
+            const decodedData = parseURLEncodedNumCharRef(parsedData).trim();
+            const { protocol: dataScheme } = new URL(decodedData);
             const dataSchemeParts = dataScheme.replace(REG_END_COLON, "").split("+");
             if (dataSchemeParts.some((s) => REG_SCRIPT_BLOB.test(s))) {
               urlToSanitize = "";
@@ -2117,46 +2117,59 @@ var parseURL = async (url) => {
   const res = urlSanitizer.parse(url);
   return res;
 };
-var sanitizeURLSync = (url, opt) => urlSanitizer.sanitize(url, opt ?? {
-  allow: [],
-  deny: [],
-  only: []
-});
+var sanitizeURLSync = (url, opt) => {
+  let res;
+  if (urlSanitizer.verify(url)) {
+    const { protocol } = new URL(url);
+    if (protocol === "blob:") {
+      URL.revokeObjectURL(url);
+    } else {
+      res = urlSanitizer.sanitize(url, opt ?? {
+        allow: [],
+        deny: [],
+        only: []
+      });
+    }
+  }
+  return res || null;
+};
 var sanitizeURL = async (url, opt = {
   allow: [],
   deny: [],
   only: []
 }) => {
-  const { protocol } = new URL(url);
   let res;
-  if (protocol === "blob:") {
-    const { allow, deny, only } = opt;
-    if (Array.isArray(allow) && allow.includes("blob") && !(Array.isArray(deny) && deny.includes("blob")) || Array.isArray(only) && only.includes("blob")) {
-      let data;
-      try {
-        data = await fetch(url).then((r) => r.blob()).then(createDataURLFromBlob);
-        URL.revokeObjectURL(url);
-      } catch (e) {
-      }
-      if (data) {
-        if (Array.isArray(only)) {
-          if (!only.includes("data")) {
-            only.push("data");
-          }
-        } else if (Array.isArray(allow)) {
-          if (!allow.includes("data")) {
-            allow.push("data");
-          }
-          if (Array.isArray(deny) && deny.includes("data")) {
-            const i = deny.indexOf("data");
-            deny.splice(i, 1);
+  if (urlSanitizer.verify(url)) {
+    const { protocol } = new URL(url);
+    if (protocol === "blob:") {
+      const { allow, deny, only } = opt;
+      if (Array.isArray(allow) && allow.includes("blob") && !(Array.isArray(deny) && deny.includes("blob")) || Array.isArray(only) && only.includes("blob")) {
+        let data;
+        try {
+          data = await fetch(url).then((r) => r.blob()).then(createDataURLFromBlob);
+        } catch (e) {
+        }
+        if (data) {
+          if (Array.isArray(only)) {
+            if (!only.includes("data")) {
+              only.push("data");
+            }
+          } else if (Array.isArray(allow)) {
+            if (!allow.includes("data")) {
+              allow.push("data");
+            }
+            if (Array.isArray(deny) && deny.includes("data")) {
+              const i = deny.indexOf("data");
+              deny.splice(i, 1);
+            }
           }
+          res = urlSanitizer.sanitize(data, opt);
         }
-        res = urlSanitizer.sanitize(data, opt);
       }
+      URL.revokeObjectURL(url);
+    } else {
+      res = urlSanitizer.sanitize(url, opt);
     }
-  } else {
-    res = urlSanitizer.sanitize(url, opt);
   }
   return res || null;
 };
@@ -2171,6 +2184,7 @@ export {
 };
 /*!
  * URL Sanitizer
+ *
  * @license MIT
  * @copyright asamuzaK (Kazz)
  * @see {@link https://github.com/asamuzaK/urlSanitizer/blob/main/LICENSE}