url-sanitizer 2.0.12 → 2.1.0

package/README.md

@@ -5,77 +5,111 @@
 [![npm](https://img.shields.io/npm/v/url-sanitizer)](https://www.npmjs.com/package/url-sanitizer)
 [![release](https://img.shields.io/github/v/release/asamuzaK/urlSanitizer)](https://github.com/asamuzaK/urlSanitizer/releases)
 
-URL sanitizer for Node.js, browsers and web sites.
-Sanitize not only regular URLs, but also data URLs and blob URLs.
-It also has the ability to parse URLs and verify URIs.
-
+A robust URL sanitizer for Node.js, browsers, and websites.
+It sanitizes not only regular URLs but also deeply inspects `data` URLs and `blob` URLs.
+It also provides built-in utilities to parse URLs and verify URI schemes.
+
+## Features
+
+* **Secure by Default**: Automatically denies `javascript:` and `vbscript:` schemes.
+* **Deep Data URL Inspection**: Parses, decodes (including base64), and sanitizes nested data URLs.
+* **Blob URL Support**: Converts and sanitizes blob URLs into safe data URLs (async).
+* **DOMPurify Integration**: Safely purifies HTML/SVG content embedded within data URLs.
+* **Pure ESM with TypeScript Support**: Works seamlessly across modern environments like Node.js, Deno, websites, and browsers (including WebExtensions).
+
+## Table of Contents
+* [Install](#install)
+* [Usage](#usage)
+* [API Reference](#api-reference)
+  * [sanitizeURL(url, opt)](#sanitizeurlurl-opt)
+  * [sanitizeURLSync(url, opt)](#sanitizeurlsyncurl-opt)
+  * [parseURL(url)](#parseurlurl)
+  * [parseURLSync(url)](#parseurlsyncurl)
+  * [isURI(uri)](#isuriuri)
+  * [isURISync(uri)](#isurisyncuri)
+  * [urlSanitizer Instance](#urlsanitizer)
+* [Acknowledgments](#acknowledgments)
 
 ## Install
 
-```console
+### Node.js
+
+``` shell
 npm i url-sanitizer
 ```
 
-For browsers and web sites, standalone ESM builds are available in `dist/` directory.
-* node_modules/url-sanitizer/dist/url-sanitizer.min.js
-* node_modules/url-sanitizer/dist/url-sanitizer-wo-dompurify.min.js
+### Deno
+
+You can import directly in your code without installing:
+``` javascript
+import urlSanitizer from "npm:url-sanitizer";
+```
 
-Or, download them from [Releases](https://github.com/asamuzaK/urlSanitizer/releases).
+### Browsers and Websites
 
-NOTE: `url-sanitizer-wo-dompurify.min.js` is built without [DOMPurify](https://www.npmjs.com/package/dompurify).
-If you use it, make sure DOMPurify is exposed globally, e.g. `window.DOMPurify`.
+Standalone ESM builds are available in the `dist/` directory:
 
+* node_modules/url-sanitizer/dist/url-sanitizer.min.js
+* node_modules/url-sanitizer/dist/url-sanitizer-wo-dompurify.min.js
+
+Alternatively, download them from [Releases](https://github.com/asamuzaK/urlSanitizer/releases).
+**NOTE:** url-sanitizer-wo-dompurify.min.js is a lightweight build without [DOMPurify](https://www.npmjs.com/package/dompurify) bundled.
+If you use this build, ensure DOMPurify is exposed globally (e.g., `window.DOMPurify`), otherwise the sanitizer will throw an error at runtime.
 
 ## Usage
 
-```javascript
+``` javascript
 import urlSanitizer, {
   isURI, isURISync, parseURL, parseURLSync, sanitizeURL, sanitizeURLSync
 } from 'url-sanitizer';
 ```
 
+## API Reference
 
-## sanitizeURL(url, opt)
+### sanitizeURL(url, opt)
 
-Sanitize the given URL.
-* `blob`, `data` and `file` schemes must be explicitly allowed.
-* Given a `blob` URL, returns a sanitized `data` URL.
+Sanitizes the given URL asynchronously.
 
-### Parameters
+* `blob`, `data`, and `file` schemes must be explicitly allowed.
+* Given a blob URL, it returns a sanitized **data** URL.
 
-* `url` **[string][1]** URL input.
-* `opt` **[object][3]?** Options.
-  * `opt.allow` **[Array][4]<[string][1]>?** Array of allowed schemes, e.g. `['data']`.
-  * `opt.deny` **[Array][4]<[string][1]>?** Array of denied schemes, e.g. `['web+foo']`.
-  * `opt.only` **[Array][4]<[string][1]>?** Array of specific schemes to allow, e.g. `['git', 'https']`.
+#### Parameters
+
+* url **string** URL input.
+* opt **object?** Options.
+  * opt.allow **Array<string>?** Array of allowed schemes, e.g., ['data'].
+  * opt.deny **Array<string>?** Array of denied schemes, e.g., ['web+foo'].
+  * opt.only **Array<string>?** Array of specific schemes to allow, e.g., ['git', 'https'].
     `only` takes precedence over `allow` and `deny`.
 
-Returns **[Promise][5]<[string][1]?>** Sanitized URL, `null`able.
+**Returns** **Promise<string?>** Sanitized URL, nullable.
+
+#### Samples
 
-```javascript
-// Sanitize tags and quotes
+Sanitize tags and quotes:
+``` javascript
 const res1 = await sanitizeURL('https://example.com/?<script>alert(1)</script>');
 // => 'https://example.com/'
 
 const res1_2 = await sanitizeURL('https://example.com/" onclick="alert(1)"');
 // => 'https://example.com/'
+```
 
-
-// Can parse and sanitize data URL
+Parse and sanitize data URLs:
+``` javascript
 const res2 = await sanitizeURL('data:text/html,<div><script>alert(1);</script></div><p onclick="alert(2)"></p>', {
   allow: ['data']
-})
+});
 // => 'data:text/html,%3Cdiv%3E%3C/div%3E%3Cp%3E%3C/p%3E'
 
 console.log(decodeURIComponent(res2));
 // => 'data:text/html,<div></div><p></p>'
 
-
-// Also can parse and sanitize base64 encoded data
+// Also can parse and sanitize base64 encoded data:
 const base64data3 = btoa('<div><script>alert(1);</script></div>');
 const res3 = await sanitizeURL(`data:text/html;base64,${base64data3}`, {
   allow: ['data']
-})
+});
 // => 'data:text/html,%3Cdiv%3E%3C/div%3E'
 
 console.log(decodeURIComponent(res3));
@@ -87,9 +121,10 @@ const res3_2 = await sanitizeURL(`data:text/html;base64,${base64data3_2}`);
 
 console.log(decodeURIComponent(res3_2));
 // => 'data:text/html,<div><img></div>'
+```
 
-
-// Can parse and sanitize blob URL
+Parse and sanitize blob URLs:
+``` javascript
 const blob4 = new Blob(['<svg><g onload="alert(1)"/></svg>'], {
   type: 'image/svg+xml'
 });
@@ -101,16 +136,18 @@ const res4 = await sanitizeURL(url4, {
 
 console.log(decodeURIComponent(res4));
 // => 'data:image/svg+xml,<svg><g></g></svg>'
+```
 
-
-// Deny if the scheme matches the `deny` list
+Denies if the scheme matches the `deny` list:
+``` javascript
 const res5 = await sanitizeURL('web+foo://example.com', {
   deny: ['web+foo']
 });
 // => null
+```
 
-
-// Allow only if the scheme matches the `only` list
+Allows only if the scheme matches the `only` list:
+``` javascript
 const res6 = await sanitizeURL('http://example.com', {
   only: ['data', 'git', 'https']
 });
@@ -121,7 +158,6 @@ const res6_2 = await sanitizeURL('https://example.com/"onmouseover="alert(1)"',
 });
 // => 'https://example.com/'
 
-
 // `only` also allows combination of the schemes in the list
 const res7 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)</script>', {
   only: ['data', 'git', 'https']
@@ -129,53 +165,38 @@ const res7 = await sanitizeURL('git+https://example.com/foo.git?<script>alert(1)
 // => 'git+https://example.com/foo.git'
 ```
 
+### sanitizeURLSync(url, opt)
 
-## sanitizeURLSync(url, opt)
+Synchronous version of `sanitizeURL()`.
 
-Synchronous version of the [sanitizeURL()](#sanitizeurlurl-opt).
 * `data` and `file` schemes must be explicitly allowed.
-* `blob` scheme is not supported, returns `null`.
-  Use async [sanitizeURL()](#sanitizeurlurl-opt) for `blob`.
+* `blob` scheme is not supported and will return `null`. Use the async version for `blob`.
 
+### parseURL(url)
 
-## parseURL(url)
+Parses the given URL asynchronously.
 
-Parse the given URL.
-* Blob URLs are simply parsed and not yet sanitized.
+* Blob URLs are simply parsed and not yet sanitized at this stage.
 
-### Parameters
-
-* `url` **[string][1]** URL input.
-
-Returns **[Promise][5]<[ParsedURL](#parsedurl)>** Result.
+#### Parameters
 
-### ParsedURL
+* url **string** URL input.
 
-Object with additional properties based on [URL](https://developer.mozilla.org/ja/docs/Web/API/URL) API.
+**Returns** **Promise<ParsedURL>** Result.
 
-Type: [object][3]
+#### ParsedURL
 
-#### Properties
+An object with additional properties based on the standard [URL](https://developer.mozilla.org/ja/docs/Web/API/URL) API.
 
-* `input` **[string][1]** URL input.
-* `valid` **[boolean][2]** Is valid URI.
-* `data` **[object][3]?** Parsed result of data URL, `null`able.
-  * `data.mime` **[string][1]?** MIME type.
-  * `data.base64` **[boolean][2]?** Is base64 encoded.
-  * `data.data` **[string][1]?** Data part of the data URL.
-* `href` **[string][1]?** Sanitized URL input.
-* `origin` **[string][1]?** Scheme, domain and port of the sanitized URL.
-* `protocol` **[string][1]?** Protocol scheme of the sanitized URL.
-* `username` **[string][1]?** Username specified before the domain name.
-* `password` **[string][1]?** Password specified before the domain name.
-* `host` **[string][1]?** Domain and port of the sanitized URL.
-* `hostname` **[string][1]?** Domain of the sanitized URL.
-* `port` **[string][1]?** Port number of the sanitized URL.
-* `pathname` **[string][1]?** Path of the sanitized URL.
-* `search` **[string][1]?** Query string of the sanitized URL.
-* `hash` **[string][1]?** Fragment identifier of the sanitized URL.
+* `input` **string** URL input.
+* `valid` **boolean** Is valid URI.
+* `data` **object?** Parsed result of data URL, nullable.
+  * `data.mime` **string?** MIME type.
+  * `data.base64` **boolean?** Is base64 encoded.
+  * `data.data` **string?** Data part of the data URL.
+* `href`, `origin`, `protocol`, `username`, `password`, `host`, `hostname`, `port`, `pathname`, `search`, `hash` — **string?** Properties same as the standard URL API.
 
-```javascript
+``` javascript
 const res1 = await parseURL('javascript:alert(1)');
 /* => {
         input: 'javascript:alert(1)',
@@ -249,25 +270,24 @@ const res5 = await parseURL(url5);
       } */
 ```
 
+### parseURLSync(url)
 
-## parseURLSync(url)
+Synchronous version of `parseURL()`.
 
-Synchronous version of the [parseURL()](#parseURL).
+### isURI(uri)
 
+Verifies if the given URI is valid and registered.
 
-## isURI(uri)
-
-Verify if the given URI is valid and registered.
+#### Parameters
 
-### Parameters
+* uri **string** URI input.
 
-* `uri` **[string][1]** URI input.
+**Returns** **Promise<boolean>** Result.
 
-Returns **[Promise][5]<[boolean][2]>** Result.
-* Always `true` for `web+*` and `ext+*` schemes, except `web+javascript`, `web+vbscript`, `ext+javascript`, `ext+vbscript`.
+* Always `true` for `web+*` and `ext+*` schemes (except `web+javascript`, `web+vbscript`, `ext+javascript`, and `ext+vbscript`).
 * `false` for `javascript` and `vbscript` schemes.
 
-```javascript
+``` javascript
 const res1 = await isURI('https://example.com/foo');
 // => true
 
@@ -287,122 +307,45 @@ const res6 = await isURI('web+javascript:alert(1)');
 // => false
 ```
 
+### isURISync(uri)
 
-## isURISync(uri)
+Synchronous version of `isURI()`.
 
-Synchronous version of the [isURI()](#isuriuri).
+### urlSanitizer
 
----
-
-## urlSanitizer
-
-Instance of the sanitizer.
+The instance of the sanitizer.
 
-### urlSanitizer.get()
+#### urlSanitizer.get()
 
-Get a list of registered URI schemes.
+Get a list of registered URI schemes (includes [IANA registered schemes](https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml) by default).
 
-Returns **[Array][4]<[string][1]>** Array of registered URI schemes.
-* Includes schemes registered at [iana.org](https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml "Uniform Resource Identifier (URI) Schemes") by default.
-  * Historical schemes omitted.
-  * `moz-extension` scheme added.
-* Also includes custom schemes added via [urlSanitizer.add()](#urlsanitizeraddscheme).
-
-```javascript
-const schemes = urlSanitizer.get();
-// => ['aaa', 'aaas', 'about', 'acap', 'acct', ...]
-```
+* Historical schemes are omitted.
+* `moz-extension` scheme is added.
 
-### urlSanitizer.has(scheme)
+#### urlSanitizer.has(scheme)
 
 Check if the given scheme is registered.
 
-#### Parameters
-
-* `scheme` **[string][1]** Scheme.
+#### urlSanitizer.add(scheme)
 
-Returns **[boolean][2]** Result.
+Add a scheme to the list of registered URI schemes (throws if `javascript` or `vbscript`).
 
-```javascript
-const res1 = urlSanitizer.has('https');
-// => true
-
-const res2 = urlSanitizer.has('foo');
-// => false
-```
-
-### urlSanitizer.add(scheme)
-
-Add a scheme to the list of registered URI schemes.
-* `javascript` and `vbscript` schemes can not be registered. It throws.
-
-#### Parameters
-
-* `scheme` **[string][1]** Scheme.
-
-Returns **[Array][4]<[string][1]>** Array of registered URI schemes.
-
-```javascript
-console.log(urlSanitizer.has('foo'));
-// => false
-
-const res = urlSanitizer.add('foo');
-// => ['aaa', 'aaas', 'about', 'acap', ... 'foo', ...]
-
-console.log(urlSanitizer.has('foo'));
-// => true
-```
-
-### urlSanitizer.remove(scheme)
+#### urlSanitizer.remove(scheme)
 
 Remove a scheme from the list of registered URI schemes.
 
-#### Parameters
-
-* `scheme` **[string][1]** Scheme.
+#### urlSanitizer.reset()
 
-Returns **[boolean][2]** Result.
-* `true` if the scheme is successfully removed, `false` otherwise.
-
-```javascript
-console.log(urlSanitizer.has('aaa'));
-// => true
-
-const res1 = urlSanitizer.remove('aaa');
-// => true
-
-console.log(urlSanitizer.has('aaa'));
-// => false
-
-const res2 = urlSanitizer.remove('foo');
-// => false
-```
-
-### urlSanitizer.reset()
-
-Reset sanitizer.
-
-Returns **void**
-
----
+Reset registered schemes to the default list and clear internal cache.
 
 ## Acknowledgments
 
-The following resources have been of great help in the development of the URL Sanitizer.
+The following resources have been of great help in the development of the URL Sanitizer:
 
 * [DOMPurify](https://www.npmjs.com/package/dompurify)
 * [Uniform Resource Identifier (URI) Schemes - IANA](https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml)
 * [Encoding -- determine the character encoding of a text file. - file/file](https://github.com/file/file/blob/master/src/encoding.c)
 
 ---
-Copyright (c) 2023 [asamuzaK (Kazz)](https://github.com/asamuzaK/)
-
-[1]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/String
 
-[2]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Boolean
-
-[3]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Object
-
-[4]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Array
-
-[5]: https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise
+Copyright (c) 2023 [asamuzaK (Kazz)](https://github.com/asamuzaK/)

package/dist/url-sanitizer-wo-dompurify.min.js

@@ -1,4 +1,4 @@
-var{DOMPurify:N}=globalThis;var H=/^[\w+/=-]+$/;var S=/data:[\w#&+./;=-]*,/,D=/data:[\w#&+./;=^]*base64,[\w+/=-]+/i,q=/data:[\w#&+./;=-]*,[^\x22]+/g,X=/&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/gi,Y=/^(?:application\/(?:[\w#&.;-]+\+)?x|image\/svg\+x|text\/(?:ht|x))ml;?/;var Q=/^[a-z][\da-z+.-]*$/,J=/^(?:ext|web)\+[a-z]+$/,j=/(?:java|vb)script/,A=/(?:java|vb)script|blob/,M=/%(?:22|27|3C|3E)|[\x22\x27<>]/,K=/^%[\dA-F]{2}$/i;var g=t=>Object.prototype.toString.call(t).slice(8,-1),d=t=>typeof t=="string"||t instanceof String;var{FileReader:V}=globalThis;var L=[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];var C=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s"];var W=t=>{if(!d(t))throw new TypeError(`Expected String but got ${g(t)}.`);let e=[];for(let s of t)e.push(`%${s.charCodeAt(0).toString(16).toUpperCase()}`);return e.join("")},Z=t=>{d(t)&&K.test(t)&&(t=t.toUpperCase());let[e,s,r,i,o,a]=["&","#","<",">",'"',"'"].map(W),c;return t===e?c=`${e}amp;`:t===r?c=`${e}lt;`:t===i?c=`${e}gt;`:t===o?c=`${e}quot;`:t===a?c=`${e}${s}39;`:c=t,c},ee=t=>{if(d(t)){if(!H.test(t))throw new Error(`Invalid base64 data: ${t}`)}else throw new TypeError(`Expected String but got ${g(t)}.`);let e=atob(t),s=Uint8Array.from([...e].map(o=>o.charCodeAt(0))),r=new Set(L),i;return s.every(o=>r.has(o))?i=e.replace(/\s/g,W):i=t,i},P=(t,e=0)=>{if(!d(t))throw new TypeError(`Expected String but got ${g(t)}.`);if(Number.isInteger(e)){if(e>16)throw new Error("Character references nested too deeply.")}else throw new TypeError(`Expected Number but got ${g(e)}.`);let s=decodeURIComponent(t);if(/&#/.test(s)){let r=new Set(L),i=[...s.matchAll(X)].reverse();for(let o of i){let[a,c]=o,l;if(/^x[\dA-F]+/i.test(c)?l=parseInt(`0${c}`,16):/^\d+/.test(c)&&(l=parseInt(c)),Number.isInteger(l)){let{index:u}=o,[p,n]=[s.substring(0,u),s.substring(u+a.length)];r.has(l)?(s=`${p}${String.fromCharCode(l)}${n}`,(/#x?$/.test(p)||/^#(?:x(?:00)?[2-7]|\d)/.test(n))&&(s=P(s,++e))):l<256&&(s=`${p}${n}`)}}}return s},te=t=>new Promise((e,s)=>{let r=new V;r.addEventListener("error",()=>s(r.error)),r.addEventListener("abort",()=>e(r.result)),r.addEventListener("load",()=>e(r.result)),r.readAsDataURL(t)}),k=class{#e;constructor(){this.#e=new Set(C)}get(){return[...this.#e]}has(e){return this.#e.has(e)}add(e){if(d(e)){if(j.test(e)||!Q.test(e))throw new Error(`Invalid scheme: ${e}`)}else throw new TypeError(`Expected String but got ${g(e)}.`);return this.#e.add(e),[...this.#e]}remove(e){return this.#e.delete(e)}verify(e){let s;if(d(e))try{let{protocol:r}=new URL(e),i=r.replace(/:$/,""),o=i.split("+");s=!j.test(i)&&J.test(i)||o.every(a=>this.#e.has(a))}catch{s=!1}return!!s}reset(){this.#e.clear();for(let e of C)this.#e.add(e)}};var O=class extends k{#e;#t;constructor(){super(),this.#e=0,this.#t=new Set}replace(e){if(!d(e))throw new TypeError(`Expected String but got ${g(e)}.`);let s=e;if(S.test(s)){let i=[...s.matchAll(q)].reverse();for(let o of i){let[a]=o;D.test(a)&&([a]=D.exec(a)),this.#e++,this.#t.add(a);let c=this.sanitize(a,{allow:["data"]}),{index:l}=o,[u,p]=[s.substring(0,l),s.substring(l+a.length)];c?s=`${u}${c}${p}`:s=`${u}${p}`}}return s}purify(e){if(!d(e))throw new TypeError(`Expected String but got ${g(e)}.`);let s=N.sanitize(decodeURIComponent(e));return s&&S.test(s)&&(s=this.replace(s)),s=s.replace(/(?:#|%23)$/,"").replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/,""),encodeURI(s)}sanitize(e,s){if(this.#e>16)throw this.#e=0,new Error("Data URLs nested too deeply.");let{allow:r,deny:i,only:o}=s??{},a=new Map([["blob",!1],["data",!1],["file",!1],["javascrpt",!1],["vbscript",!1]]),c=new Set,l=!1;if(Array.isArray(o)&&o.length){let p=super.get();for(let m of p)a.set(m,!1);let n=Object.values(o);for(let m of n)if(d(m)&&(m=m.trim(),!A.test(m))){if(super.has(m))a.set(m,!0);else{try{super.add(m)}catch{}super.has(m)&&(a.set(m,!0),c.add(m))}!l&&a.has(m)&&(l=a.get(m))}}else{if(Array.isArray(r)&&r.length){let p=Object.values(r);for(let n of p)if(d(n)&&(n=n.trim(),!A.test(n)))if(super.has(n))a.set(n,!0);else{try{super.add(n)}catch{}super.has(n)&&(a.set(n,!0),c.add(n))}}if(Array.isArray(i)&&i.length){let p=Object.values(i);for(let n of p)d(n)&&(n=n.trim(),n&&a.set(n,!1))}}let u;if(super.verify(e)){let{hash:p,href:n,pathname:m,protocol:U,search:x}=new URL(e),E=U.replace(/:$/,""),G=E.split("+"),_;if(l)_=G.every(y=>a.get(y));else for(let[y,R]of a.entries())if(_=R||E!==y&&G.every(f=>f!==y),!_)break;if(_){let y=G.includes("data"),R,f=n;if(y){let[v,...z]=m.split(","),$=`${z.join(",")}${x}${p}`,T=v.split(";"),I=T[T.length-1]==="base64",h=$;I&&(h=ee($));try{let F=P(h).trim(),{protocol:se}=new URL(F);se.replace(/:$/,"").split("+").some(re=>A.test(re))&&(f="")}catch{}let B=S.test(h);h!==$||B?B?h=this.replace(h):this.#t.has(e)?this.#t.delete(e):R=!0:this.#t.has(e)?this.#t.delete(e):R=!0,(!v||Y.test(v))&&(h=this.purify(h)),f&&h?(I&&h!==$&&T.pop(),f=`${E}:${T.join(";")},${h}`):f=""}else R=!0;if(!y&&M.test(f)){let v=M.exec(f),{index:z}=v;f=f.substring(0,z).replace(/[?&]$/,"")}f?(u=f.replace(/%26/g,Z),R&&(this.#e=0)):this.#e=0}c.size&&c.forEach(y=>{super.remove(y)})}return u||null}parse(e,s){if(!d(e))throw new TypeError(`Expected String but got ${g(e)}.`);let r=new Map([["input",e]]),i;if(this.verify(e)){let{protocol:o}=new URL(e);o==="blob:"?i=e:i=this.sanitize(e,s??{allow:["data","file"]})}if(i){let o=new URL(i),{pathname:a,protocol:c}=o,u=c.replace(/:$/,"").split("+").includes("data");if(r.set("valid",!0),u){let p=new Map,[n,...m]=a.split(","),U=`${m.join(",")}`,x=n.split(";"),E=x[x.length-1]==="base64";E&&x.pop(),p.set("mime",x.join(";")),p.set("base64",E),p.set("data",U),r.set("data",Object.fromEntries(p))}else r.set("data",null);for(let p in o){let n=o[p];d(n)&&r.set(p,n)}}else r.set("valid",!1);return Object.fromEntries(r)}reset(){super.reset(),this.#e=0,this.#t.clear()}},b=new O,ce=async(t,e={allow:[],deny:[],only:[]})=>{let s;if(t&&d(t)){let r;try{let{protocol:i}=new URL(t);r=i.replace(/:$/,"")}catch{}if(r==="blob"){let{allow:i,deny:o,only:a}=e;if(Array.isArray(i)&&i.includes("blob")&&!(Array.isArray(o)&&o.includes("blob"))||Array.isArray(a)&&a.includes("blob")){let c;try{c=await fetch(t).then(l=>l.blob()).then(te)}catch{}if(c){if(Array.isArray(a))a.includes("data")||a.push("data");else if(Array.isArray(i)&&(i.includes("data")||i.push("data"),Array.isArray(o)&&o.includes("data"))){let l=o.indexOf("data");o.splice(l,1)}s=b.sanitize(c,e)}}URL.revokeObjectURL(t)}else r&&(s=b.sanitize(t,e))}return s||null},pe=(t,e)=>{let s;if(t&&d(t)){let r;try{let{protocol:i}=new URL(t);r=i.replace(/:$/,"")}catch{}r==="blob"?URL.revokeObjectURL(t):r&&(s=b.sanitize(t,e))}return s||null},le=async t=>b.parse(t),me=t=>b.parse(t),de=async t=>b.verify(t),fe=t=>b.verify(t),he=b;export{he as default,de as isURI,fe as isURISync,le as parseURL,me as parseURLSync,ce as sanitizeURL,pe as sanitizeURLSync};
+var N={sanitize:(...t)=>{if(globalThis?.DOMPurify)return globalThis.DOMPurify.sanitize(...t);let e=["DOMPurify is not available.","Ensure DOMPurify is exposed globally (e.g., window.DOMPurify)."];throw new Error(e.join(" "))}};var H=/^[\w+/=-]+$/;var S=/data:[\w#&+./;=-]*,/,G=/data:[\w#&+./;=^]*base64,[\w+/=-]+/i,q=/data:[\w#&+./;=-]*,[^\x22]+/g,X=/&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/gi,Y=/^(?:application\/(?:[\w#&.;-]+\+)?x|image\/svg\+x|text\/(?:ht|x))ml;?/;var Q=/^[a-z][\da-z+.-]*$/,J=/^(?:ext|web)\+[a-z]+$/,M=/(?:java|vb)script/,A=/(?:java|vb)script|blob/,j=/%(?:22|27|3C|3E)|[\x22\x27<>]/,K=/^%[\dA-F]{2}$/i;var g=t=>Object.prototype.toString.call(t).slice(8,-1),d=t=>typeof t=="string"||t instanceof String;var{FileReader:V}=globalThis;var L=[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255];var C=["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s"];var W=t=>{if(!d(t))throw new TypeError(`Expected String but got ${g(t)}.`);let e=[];for(let s of t)e.push(`%${s.charCodeAt(0).toString(16).toUpperCase()}`);return e.join("")},Z=t=>{d(t)&&K.test(t)&&(t=t.toUpperCase());let[e,s,r,i,o,a]=["&","#","<",">",'"',"'"].map(W),c;return t===e?c=`${e}amp;`:t===r?c=`${e}lt;`:t===i?c=`${e}gt;`:t===o?c=`${e}quot;`:t===a?c=`${e}${s}39;`:c=t,c},ee=t=>{if(d(t)){if(!H.test(t))throw new Error(`Invalid base64 data: ${t}`)}else throw new TypeError(`Expected String but got ${g(t)}.`);let e=atob(t),s=Uint8Array.from([...e].map(o=>o.charCodeAt(0))),r=new Set(L),i;return s.every(o=>r.has(o))?i=e.replace(/\s/g,W):i=t,i},P=(t,e=0)=>{if(!d(t))throw new TypeError(`Expected String but got ${g(t)}.`);if(Number.isInteger(e)){if(e>16)throw new Error("Character references nested too deeply.")}else throw new TypeError(`Expected Number but got ${g(e)}.`);let s=decodeURIComponent(t);if(/&#/.test(s)){let r=new Set(L),i=[...s.matchAll(X)].reverse();for(let o of i){let[a,c]=o,l;if(/^x[\dA-F]+/i.test(c)?l=parseInt(`0${c}`,16):/^\d+/.test(c)&&(l=parseInt(c)),Number.isInteger(l)){let{index:u}=o,[p,n]=[s.substring(0,u),s.substring(u+a.length)];r.has(l)?(s=`${p}${String.fromCharCode(l)}${n}`,(/#x?$/.test(p)||/^#(?:x(?:00)?[2-7]|\d)/.test(n))&&(s=P(s,++e))):l<256&&(s=`${p}${n}`)}}}return s},te=t=>new Promise((e,s)=>{let r=new V;r.addEventListener("error",()=>s(r.error)),r.addEventListener("abort",()=>e(r.result)),r.addEventListener("load",()=>e(r.result)),r.readAsDataURL(t)}),k=class{#e;constructor(){this.#e=new Set(C)}get(){return[...this.#e]}has(e){return this.#e.has(e)}add(e){if(d(e)){if(M.test(e)||!Q.test(e))throw new Error(`Invalid scheme: ${e}`)}else throw new TypeError(`Expected String but got ${g(e)}.`);return this.#e.add(e),[...this.#e]}remove(e){return this.#e.delete(e)}verify(e){let s;if(d(e))try{let{protocol:r}=new URL(e),i=r.replace(/:$/,""),o=i.split("+");s=!M.test(i)&&J.test(i)||o.every(a=>this.#e.has(a))}catch{s=!1}return!!s}reset(){this.#e.clear();for(let e of C)this.#e.add(e)}};var O=class extends k{#e;#t=new Set;constructor(){super(),this.#e=0}replace(e){if(!d(e))throw new TypeError(`Expected String but got ${g(e)}.`);let s=e;if(S.test(s)){let i=[...s.matchAll(q)].reverse();for(let o of i){let[a]=o;G.test(a)&&([a]=G.exec(a)),this.#e++,this.#t.add(a);let c=this.sanitize(a,{allow:["data"]}),{index:l}=o,[u,p]=[s.substring(0,l),s.substring(l+a.length)];c?s=`${u}${c}${p}`:s=`${u}${p}`}}return s}purify(e){if(!d(e))throw new TypeError(`Expected String but got ${g(e)}.`);let s=N.sanitize(decodeURIComponent(e));return s&&S.test(s)&&(s=this.replace(s)),s=s.replace(/(?:#|%23)$/,"").replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/,""),encodeURI(s)}sanitize(e,s){if(this.#e>16)throw this.#e=0,new Error("Data URLs nested too deeply.");let{allow:r,deny:i,only:o}=s??{},a=new Map([["blob",!1],["data",!1],["file",!1],["javascrpt",!1],["vbscript",!1]]),c=new Set,l=!1;if(Array.isArray(o)&&o.length){let p=super.get();for(let m of p)a.set(m,!1);let n=Object.values(o);for(let m of n)if(d(m)&&(m=m.trim(),!A.test(m))){if(super.has(m))a.set(m,!0);else{try{super.add(m)}catch{}super.has(m)&&(a.set(m,!0),c.add(m))}!l&&a.has(m)&&(l=a.get(m))}}else{if(Array.isArray(r)&&r.length){let p=Object.values(r);for(let n of p)if(d(n)&&(n=n.trim(),!A.test(n)))if(super.has(n))a.set(n,!0);else{try{super.add(n)}catch{}super.has(n)&&(a.set(n,!0),c.add(n))}}if(Array.isArray(i)&&i.length){let p=Object.values(i);for(let n of p)d(n)&&(n=n.trim(),n&&a.set(n,!1))}}let u;if(super.verify(e)){let{hash:p,href:n,pathname:m,protocol:U,search:x}=new URL(e),E=U.replace(/:$/,""),z=E.split("+"),_;if(l)_=z.every(y=>a.get(y));else for(let[y,R]of a.entries())if(_=R||E!==y&&z.every(f=>f!==y),!_)break;if(_){let y=z.includes("data"),R,f=n;if(y){let[v,...D]=m.split(","),$=`${D.join(",")}${x}${p}`,T=v.split(";"),I=T[T.length-1]==="base64",h=$;I&&(h=ee($));try{let F=P(h).trim(),{protocol:se}=new URL(F);se.replace(/:$/,"").split("+").some(re=>A.test(re))&&(f="")}catch{}let B=S.test(h);h!==$||B?B?h=this.replace(h):this.#t.has(e)?this.#t.delete(e):R=!0:this.#t.has(e)?this.#t.delete(e):R=!0,(!v||Y.test(v))&&(h=this.purify(h)),f&&h?(I&&h!==$&&T.pop(),f=`${E}:${T.join(";")},${h}`):f=""}else R=!0;if(!y&&j.test(f)){let v=j.exec(f),{index:D}=v;f=f.substring(0,D).replace(/[?&]$/,"")}f?(u=f.replace(/%26/g,Z),R&&(this.#e=0)):this.#e=0}c.size&&c.forEach(y=>{super.remove(y)})}return u||null}parse(e,s){if(!d(e))throw new TypeError(`Expected String but got ${g(e)}.`);let r=new Map([["input",e]]),i;if(this.verify(e)){let{protocol:o}=new URL(e);o==="blob:"?i=e:i=this.sanitize(e,s??{allow:["data","file"]})}if(i){let o=new URL(i),{pathname:a,protocol:c}=o,u=c.replace(/:$/,"").split("+").includes("data");if(r.set("valid",!0),u){let p=new Map,[n,...m]=a.split(","),U=`${m.join(",")}`,x=n.split(";"),E=x[x.length-1]==="base64";E&&x.pop(),p.set("mime",x.join(";")),p.set("base64",E),p.set("data",U),r.set("data",Object.fromEntries(p))}else r.set("data",null);for(let p in o){let n=o[p];d(n)&&r.set(p,n)}}else r.set("valid",!1);return Object.fromEntries(r)}reset(){super.reset(),this.#e=0,this.#t.clear()}};var b=new O,ce=async(t,e={allow:[],deny:[],only:[]})=>{let s;if(t&&d(t)){let r;try{let{protocol:i}=new URL(t);r=i.replace(/:$/,"")}catch{}if(r==="blob"){let{allow:i,deny:o,only:a}=e;if(Array.isArray(i)&&i.includes("blob")&&!(Array.isArray(o)&&o.includes("blob"))||Array.isArray(a)&&a.includes("blob")){let c;try{c=await fetch(t).then(l=>l.blob()).then(te)}catch{}if(c){if(Array.isArray(a))a.includes("data")||a.push("data");else if(Array.isArray(i)&&(i.includes("data")||i.push("data"),Array.isArray(o)&&o.includes("data"))){let l=o.indexOf("data");o.splice(l,1)}s=b.sanitize(c,e)}}URL.revokeObjectURL(t)}else r&&(s=b.sanitize(t,e))}return s||null},pe=(t,e)=>{let s;if(t&&d(t)){let r;try{let{protocol:i}=new URL(t);r=i.replace(/:$/,"")}catch{}r==="blob"?URL.revokeObjectURL(t):r&&(s=b.sanitize(t,e))}return s||null},le=async t=>b.parse(t),me=t=>b.parse(t),de=async t=>b.verify(t),fe=t=>b.verify(t),he=b;export{he as default,de as isURI,fe as isURISync,le as parseURL,me as parseURLSync,ce as sanitizeURL,pe as sanitizeURLSync};
 /*!
  * URL Sanitizer
  *