url-sanitizer 2.0.13 → 2.2.0

package/package.json

@@ -15,6 +15,7 @@
     "types"
   ],
   "type": "module",
+  "types": "./types/index.d.ts",
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
@@ -24,12 +25,12 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "dompurify": "^3.4.2",
+    "dompurify": "^3.4.3",
     "jsdom": "^29.1.1"
   },
   "devDependencies": {
-    "@types/jsdom": "^28.0.1",
-    "@types/node": "^25.6.2",
+    "@types/jsdom": "^28.0.3",
+    "@types/node": "^25.8.0",
     "c8": "^11.0.0",
     "chai": "^6.2.2",
     "commander": "^14.0.3",
@@ -78,5 +79,5 @@
     "test:bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
-  "version": "2.0.13"
+  "version": "2.2.0"
 }

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s"]
+["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/constant.js

@@ -3,7 +3,9 @@
  */
 
 /* numeric */
+export const CHUNK_SIZE = 8 * 1024;
 export const HEX = 16;
+export const MAX_BLOB_SIZE = 32 * 1024 * 1024;
 export const TYPE_FROM = 8;
 export const TYPE_TO = -1;
 

package/src/mjs/file-reader.js

@@ -7,7 +7,9 @@ import { getType, isString } from './common.js';
 import { textChars } from './lib-util.js';
 
 /* constants */
-import { REG_CHARSET, REG_MIME_DOM, REG_MIME_TEXT } from './constant.js';
+import {
+  CHUNK_SIZE, REG_CHARSET, REG_MIME_DOM, REG_MIME_TEXT
+} from './constant.js';
 const DONE = 2;
 const EMPTY = 0;
 const LOADING = 1;
@@ -163,7 +165,11 @@ export class FileReader extends EventTarget {
         const mediaTypes = type ? type.split(';') : [];
         const buffer = await blob.arrayBuffer();
         const uint8arr = new Uint8Array(buffer);
-        const binary = String.fromCharCode(...uint8arr);
+        const chunkSize = CHUNK_SIZE;
+        let binary = '';
+        for (let i = 0; i < uint8arr.length; i += chunkSize) {
+          binary += String.fromCharCode(...uint8arr.subarray(i, i + chunkSize));
+        }
         this._dispatchProgressEvent('loadstart');
         switch (format) {
           case 'arrayBuffer':

package/src/mjs/sanitizer.js

@@ -10,8 +10,8 @@ import {
   parseURLEncodedNumCharRef, URISchemes
 } from './uri-util.js';
 import {
-  HEX, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G, REG_MIME_DOM,
-  REG_SCRIPT_BLOB, REG_TAG_QUOT
+  HEX, MAX_BLOB_SIZE, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G,
+  REG_MIME_DOM, REG_SCRIPT_BLOB, REG_TAG_QUOT
 } from './constant.js';
 
 /* typedef */
@@ -36,6 +36,18 @@ import {
  * @property {string} [hash] - fragment identifier of the sanitized URL
  */
 
+/**
+ * Internal debug logger.
+ * @param {boolean} isDebug - Debug flag.
+ * @param {string} message - Output message.
+ * @param {Error} [error] - Caught error object.
+ */
+export const logDebug = (isDebug, message, error) => {
+  if (isDebug) {
+    console.warn(`[URLSanitizer Debug] ${message}`, error ? error.message : '');
+  }
+};
+
 /**
  * URL sanitizer
  */
@@ -125,7 +137,7 @@ class URLSanitizer extends URISchemes {
       this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
-    const { allow, deny, only } = opt ?? {};
+    const { allow, deny, only, debug = false } = opt ?? {};
     const schemeMap = new Map([
       ['blob', false],
       ['data', false],
@@ -151,7 +163,8 @@ class URLSanitizer extends URISchemes {
               try {
                 super.add(item);
               } catch (e) {
-                // fall through
+                const msg = `Failed to add scheme '${item}' in 'only' list.`;
+                logDebug(debug, msg, e);
               }
               if (super.has(item)) {
                 schemeMap.set(item, true);
@@ -177,7 +190,8 @@ class URLSanitizer extends URISchemes {
                 try {
                   super.add(item);
                 } catch (e) {
-                  // fall through
+                  const msg = `Failed to add scheme '${item}' in 'allow' list.`;
+                  logDebug(debug, msg, e);
                 }
                 if (super.has(item)) {
                   schemeMap.set(item, true);
@@ -237,7 +251,8 @@ class URLSanitizer extends URISchemes {
               urlToSanitize = '';
             }
           } catch (e) {
-            // fall through
+            const msg = 'Failed to parse inner data URL protocol.';
+            logDebug(debug, msg, e);
           }
           const containsDataUrl = REG_DATA_URL.test(parsedData);
           if (parsedData !== data || containsDataUrl) {
@@ -383,8 +398,14 @@ const urlSanitizer = new URLSanitizer();
 export const sanitizeURL = async (url, opt = {
   allow: [],
   deny: [],
-  only: []
+  only: [],
+  debug: false,
+  maxBlobSize: MAX_BLOB_SIZE
 }) => {
+  const isDebug = !!opt?.debug;
+  const maxBlobSize = Number.isInteger(opt?.maxBlobSize) && opt.maxBlobSize > 0
+    ? opt.maxBlobSize
+    : MAX_BLOB_SIZE;
   let res;
   if (url && isString(url)) {
     let scheme;
@@ -392,7 +413,7 @@ export const sanitizeURL = async (url, opt = {
       const { protocol } = new URL(url);
       scheme = protocol.replace(/:$/, '');
     } catch (e) {
-      // fall through;
+      logDebug(isDebug, `Invalid URL input format: ${url}`, e);
     }
     if (scheme === 'blob') {
       const { allow, deny, only } = opt;
@@ -401,10 +422,12 @@ export const sanitizeURL = async (url, opt = {
           (Array.isArray(only) && only.includes('blob'))) {
         let data;
         try {
-          data =
-            await fetch(url).then(r => r.blob()).then(createDataURLFromBlob);
+          data = await fetch(url)
+            .then(r => r.blob())
+            .then(b => createDataURLFromBlob(b, maxBlobSize));
         } catch (e) {
-          // fall through
+          const msg = `Failed to fetch and convert blob URL: ${url}`;
+          logDebug(isDebug, msg, e);
         }
         if (data) {
           if (Array.isArray(only)) {
@@ -450,7 +473,8 @@ export const sanitizeURLSync = (url, opt) => {
       const { protocol } = new URL(url);
       scheme = protocol.replace(/:$/, '');
     } catch (e) {
-      // fall through;
+      const msg = `Failed to parse URL: ${url}`;
+      logDebug(opt?.debug, msg, e);
     }
     if (scheme === 'blob') {
       URL.revokeObjectURL(url);

package/src/mjs/uri-util.js

@@ -8,7 +8,8 @@ import { FileReader } from './file-reader.js';
 import { textChars, uriSchemes } from './lib-util.js';
 
 import {
-  HEX, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT, REG_SCRIPT, REG_URL_ENC
+  HEX, MAX_BLOB_SIZE, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT,
+  REG_SCRIPT, REG_URL_ENC
 } from './constant.js';
 
 /**
@@ -128,15 +129,25 @@ export const parseURLEncodedNumCharRef = (str, nest = 0) => {
 /**
  * create data URL from blob
  * @param {object} blob - blob
+ * @param {number} maxBlobSize - max blob size
  * @returns {Promise.<?string>} - data URL
  */
-export const createDataURLFromBlob = blob => new Promise((resolve, reject) => {
-  const reader = new FileReader();
-  reader.addEventListener('error', () => reject(reader.error));
-  reader.addEventListener('abort', () => resolve(reader.result));
-  reader.addEventListener('load', () => resolve(reader.result));
-  reader.readAsDataURL(blob);
-});
+export const createDataURLFromBlob = (blob, maxBlobSize = MAX_BLOB_SIZE) =>
+  new Promise((resolve, reject) => {
+    if (!Number.isInteger(blob?.size)) {
+      return resolve(null);
+    } else if (Number.isInteger(maxBlobSize) && blob.size > maxBlobSize) {
+      return reject(new DOMException(
+        `Blob size (${blob.size} bytes) exceeds the maximum allowed size of ${maxBlobSize} bytes.`,
+        'NotReadableError'
+      ));
+    }
+    const reader = new FileReader();
+    reader.addEventListener('error', () => reject(reader.error));
+    reader.addEventListener('abort', () => resolve(reader.result));
+    reader.addEventListener('load', () => resolve(reader.result));
+    reader.readAsDataURL(blob);
+  });
 
 /**
  * URI schemes

package/types/mjs/constant.d.ts

@@ -1,4 +1,6 @@
+export const CHUNK_SIZE: number;
 export const HEX: 16;
+export const MAX_BLOB_SIZE: number;
 export const TYPE_FROM: 8;
 export const TYPE_TO: -1;
 export const REG_B64: RegExp;

package/types/mjs/sanitizer.d.ts

@@ -1,3 +1,4 @@
+export function logDebug(isDebug: boolean, message: string, error?: Error): void;
 export function sanitizeURL(url: string, opt?: {
     allow?: string[] | undefined;
     deny?: string[] | undefined;

package/types/mjs/uri-util.d.ts

@@ -2,7 +2,7 @@ export function getURLEncodedString(str: string): string;
 export function escapeURLEncodedHTMLChars(ch: string): string;
 export function parseBase64(data: string): string;
 export function parseURLEncodedNumCharRef(str: string, nest?: number): string;
-export function createDataURLFromBlob(blob: object): Promise<string | null>;
+export function createDataURLFromBlob(blob: object, maxBlobSize?: number): Promise<string | null>;
 export class URISchemes {
     get(): Array<string>;
     has(scheme: string): boolean;