url-sanitizer 1.0.2 → 2.0.0

package/package.json

@@ -21,12 +21,12 @@
   },
   "types": "types/index.d.ts",
   "dependencies": {
-    "dompurify": "^3.0.9",
+    "dompurify": "^3.0.11",
     "jsdom": "^24.0.0"
   },
   "devDependencies": {
-    "@babel/eslint-parser": "^7.23.10",
-    "@babel/plugin-syntax-import-assertions": "^7.23.3",
+    "@babel/eslint-parser": "^7.24.1",
+    "@babel/plugin-syntax-import-assertions": "^7.24.1",
     "@types/dompurify": "^3.0.5",
     "@types/jsdom": "^21.1.6",
     "c8": "^9.1.0",
@@ -34,19 +34,19 @@
     "commander": "^12.0.0",
     "copyfiles": "^2.4.1",
     "csvtojson": "^2.0.10",
-    "esbuild": "^0.20.1",
-    "eslint": "^8.56.0",
+    "esbuild": "^0.20.2",
+    "eslint": "^8.57.0",
     "eslint-config-standard": "^17.1.0",
     "eslint-plugin-import": "^2.29.1",
-    "eslint-plugin-jsdoc": "^48.2.0",
-    "eslint-plugin-regexp": "^2.2.0",
+    "eslint-plugin-jsdoc": "^48.2.1",
+    "eslint-plugin-regexp": "^2.3.0",
     "eslint-plugin-unicorn": "^51.0.1",
     "http-server": "^14.1.1",
     "mocha": "^10.3.0",
     "npm-run-all": "^4.1.5",
     "sinon": "^17.0.1",
-    "typescript": "^5.3.3",
-    "undici": "^6.6.2"
+    "typescript": "^5.4.3",
+    "undici": "^6.10.1"
   },
   "scripts": {
     "build": "npm run include && npm run tsc && npm run lint && npm test && npm run copy && npm run bundle",
@@ -65,5 +65,5 @@
     "test-bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node modules/index clean --dir=types -i && npx tsc"
   },
-  "version": "1.0.2"
+  "version": "2.0.0"
 }

package/src/mjs/constant.js

@@ -22,6 +22,4 @@ export const REG_SCHEME_EXT = /^(?:ext|web)\+[a-z]+$/;
 export const REG_SCRIPT = /(?:java|vb)script/;
 export const REG_SCRIPT_BLOB = /(?:java|vb)script|blob/;
 export const REG_TAG_QUOT = /%(?:2[27]|3[CE])|[<>"']/;
-export const REG_TAG_QUOT_ENC_G = /%(?:2[27]|3[CE])/g;
-export const REG_TAG_QUOT_SPACE_G = /[<>"'\s]/g;
 export const REG_URL_ENC = /^%[\dA-F]{2}$/i;

package/src/mjs/sanitizer.js

@@ -6,12 +6,12 @@
 import { domPurify } from './dompurify.js';
 import { getType, isString } from './common.js';
 import {
-  createDataURLFromBlob, escapeURLEncodedHTMLChars, getURLEncodedString,
-  parseBase64, parseURLEncodedNumCharRef, URISchemes
+  createDataURLFromBlob, escapeURLEncodedHTMLChars, parseBase64,
+  parseURLEncodedNumCharRef, URISchemes
 } from './uri-util.js';
 import {
   HEX, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G, REG_MIME_DOM,
-  REG_SCRIPT_BLOB, REG_TAG_QUOT, REG_TAG_QUOT_ENC_G, REG_TAG_QUOT_SPACE_G
+  REG_SCRIPT_BLOB, REG_TAG_QUOT
 } from './constant.js';
 
 /* typedef */
@@ -119,7 +119,6 @@ export class URLSanitizer extends URISchemes {
    * @param {Array.<string>} [opt.allow] - array of allowed schemes
    * @param {Array.<string>} [opt.deny] - array of denied schemes
    * @param {Array.<string>} [opt.only] - array of specific schemes to allow
-   * @param {boolean} [opt.remove] - remove tag and/or quote and the rest
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt) {
@@ -127,7 +126,7 @@ export class URLSanitizer extends URISchemes {
       this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
-    const { allow, deny, only, remove } = opt ?? {};
+    const { allow, deny, only } = opt ?? {};
     const schemeMap = new Map([
       ['blob', false],
       ['data', false],
@@ -269,20 +268,16 @@ export class URLSanitizer extends URISchemes {
         } else {
           finalize = true;
         }
-        if (!isDataUrl && remove && REG_TAG_QUOT.test(urlToSanitize)) {
+        if (!isDataUrl && REG_TAG_QUOT.test(urlToSanitize)) {
           const item = REG_TAG_QUOT.exec(urlToSanitize);
           const { index } = item;
-          urlToSanitize = urlToSanitize.substring(0, index);
+          urlToSanitize =
+            urlToSanitize.substring(0, index).replace(/[?&]$/, '');
         }
         if (urlToSanitize) {
-          sanitizedUrl = urlToSanitize
-            .replace(REG_TAG_QUOT_SPACE_G, getURLEncodedString)
-            .replace(/%26/g, escapeURLEncodedHTMLChars);
+          sanitizedUrl =
+            urlToSanitize.replace(/%26/g, escapeURLEncodedHTMLChars);
           if (finalize) {
-            if (!isDataUrl) {
-              sanitizedUrl = sanitizedUrl
-                .replace(REG_TAG_QUOT_ENC_G, escapeURLEncodedHTMLChars);
-            }
             this.#nest = 0;
           }
         } else {
@@ -305,7 +300,6 @@ export class URLSanitizer extends URISchemes {
    * @param {Array.<string>} [opt.allow] - array of allowed schemes
    * @param {Array.<string>} [opt.deny] - array of denied schemes
    * @param {Array.<string>} [opt.only] - array of specific schemes to allow
-   * @param {boolean} [opt.remove] - remove tag and/or quote and the rest
    * @returns {ParsedURL} - result with additional props based on URL API
    */
   parse(url, opt) {
@@ -384,7 +378,6 @@ const urlSanitizer = new URLSanitizer();
  * @param {Array.<string>} [opt.allow] - array of allowed schemes
  * @param {Array.<string>} [opt.deny] - array of denied schemes
  * @param {Array.<string>} [opt.only] - array of specific schemes to allow
- * @param {boolean} [opt.remove] - remove tag and/or quote and the rest
  * @returns {Promise.<?string>} - sanitized URL
  */
 export const sanitizeURL = async (url, opt = {
@@ -447,7 +440,6 @@ export const sanitizeURL = async (url, opt = {
  * @param {Array.<string>} [opt.allow] - array of allowed schemes
  * @param {Array.<string>} [opt.deny] - array of denied schemes
  * @param {Array.<string>} [opt.only] - array of specific schemes to allow
- * @param {boolean} [opt.remove] - remove tag and/or quote and the rest
  * @returns {?string} - sanitized URL
  */
 export const sanitizeURLSync = (url, opt) => {

package/types/mjs/constant.d.ts

@@ -14,6 +14,4 @@ export const REG_SCHEME_EXT: RegExp;
 export const REG_SCRIPT: RegExp;
 export const REG_SCRIPT_BLOB: RegExp;
 export const REG_TAG_QUOT: RegExp;
-export const REG_TAG_QUOT_ENC_G: RegExp;
-export const REG_TAG_QUOT_SPACE_G: RegExp;
 export const REG_URL_ENC: RegExp;

package/types/mjs/sanitizer.d.ts

@@ -5,13 +5,11 @@ export class URLSanitizer extends URISchemes {
         allow?: Array<string>;
         deny?: Array<string>;
         only?: Array<string>;
-        remove?: boolean;
     }): string | null;
     parse(url: string, opt?: {
         allow?: Array<string>;
         deny?: Array<string>;
         only?: Array<string>;
-        remove?: boolean;
     }): ParsedURL;
     #private;
 }
@@ -19,13 +17,11 @@ export function sanitizeURL(url: string, opt?: {
     allow?: Array<string>;
     deny?: Array<string>;
     only?: Array<string>;
-    remove?: boolean;
 }): Promise<string | null>;
 export function sanitizeURLSync(url: string, opt?: {
     allow?: Array<string>;
     deny?: Array<string>;
     only?: Array<string>;
-    remove?: boolean;
 }): string | null;
 export function parseURL(url: string): Promise<ParsedURL>;
 export function parseURLSync(url: string): ParsedURL;