url-sanitizer 2.1.0 → 2.3.0

package/package.json

@@ -29,6 +29,7 @@
     "jsdom": "^29.1.1"
   },
   "devDependencies": {
+    "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^25.8.0",
     "c8": "^11.0.0",
@@ -40,13 +41,16 @@
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-regexp": "^3.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
+    "fast-check": "^4.8.0",
     "globals": "^17.6.0",
     "http-server": "^14.1.1",
+    "mitata": "^1.0.34",
     "mocha": "^11.7.5",
     "neostandard": "^0.13.0",
     "npm-run-all2": "^8.0.4",
     "papaparse": "^5.5.3",
     "sinon": "^22.0.0",
+    "strict-url-sanitise": "^0.0.1",
     "typescript": "^6.0.3",
     "undici": "^8.0.2"
   },
@@ -63,6 +67,7 @@
     "serialize-javascript": "^7.0.4"
   },
   "scripts": {
+    "bench": "node benchmark/benchmark.js",
     "build": "npm run include && npm run tsc && npm run lint && npm test && npm run copy && npm run bundle",
     "bundle": "npm-run-all -s bundle:*",
     "bundle:min": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer.min.js --bundle --minify --sourcemap bundle/index.js",
@@ -79,5 +84,5 @@
     "test:bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
-  "version": "2.1.0"
+  "version": "2.3.0"
 }

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s"]
+["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/constant.js

@@ -3,7 +3,9 @@
  */
 
 /* numeric */
+export const CHUNK_SIZE = 8 * 1024;
 export const HEX = 16;
+export const MAX_BLOB_SIZE = 32 * 1024 * 1024;
 export const TYPE_FROM = 8;
 export const TYPE_TO = -1;
 

package/src/mjs/file-reader.js

@@ -7,7 +7,9 @@ import { getType, isString } from './common.js';
 import { textChars } from './lib-util.js';
 
 /* constants */
-import { REG_CHARSET, REG_MIME_DOM, REG_MIME_TEXT } from './constant.js';
+import {
+  CHUNK_SIZE, REG_CHARSET, REG_MIME_DOM, REG_MIME_TEXT
+} from './constant.js';
 const DONE = 2;
 const EMPTY = 0;
 const LOADING = 1;
@@ -163,7 +165,11 @@ export class FileReader extends EventTarget {
         const mediaTypes = type ? type.split(';') : [];
         const buffer = await blob.arrayBuffer();
         const uint8arr = new Uint8Array(buffer);
-        const binary = String.fromCharCode(...uint8arr);
+        const chunkSize = CHUNK_SIZE;
+        let binary = '';
+        for (let i = 0; i < uint8arr.length; i += chunkSize) {
+          binary += String.fromCharCode(...uint8arr.subarray(i, i + chunkSize));
+        }
         this._dispatchProgressEvent('loadstart');
         switch (format) {
           case 'arrayBuffer':

package/src/mjs/sanitizer.js

@@ -10,8 +10,8 @@ import {
   parseURLEncodedNumCharRef, URISchemes
 } from './uri-util.js';
 import {
-  HEX, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G, REG_MIME_DOM,
-  REG_SCRIPT_BLOB, REG_TAG_QUOT
+  HEX, MAX_BLOB_SIZE, REG_DATA_URL, REG_DATA_URL_B64, REG_DATA_URL_G,
+  REG_MIME_DOM, REG_SCRIPT_BLOB, REG_TAG_QUOT
 } from './constant.js';
 
 /* typedef */
@@ -36,6 +36,18 @@ import {
  * @property {string} [hash] - fragment identifier of the sanitized URL
  */
 
+/**
+ * Internal debug logger.
+ * @param {boolean} isDebug - Debug flag.
+ * @param {string} message - Output message.
+ * @param {Error} [error] - Caught error object.
+ */
+export const logDebug = (isDebug, message, error) => {
+  if (isDebug) {
+    console.warn(`[URLSanitizer Debug] ${message}`, error ? error.message : '');
+  }
+};
+
 /**
  * URL sanitizer
  */
@@ -99,13 +111,26 @@ class URLSanitizer extends URISchemes {
     if (!isString(dom)) {
       throw new TypeError(`Expected String but got ${getType(dom)}.`);
     }
-    let purifiedDom = domPurify.sanitize(decodeURIComponent(dom));
+    let decodedDom = dom;
+    try {
+      // prevent URIError caused by malformed percent-encoding
+      // e.g., a standalone '%'
+      decodedDom = decodeURIComponent(dom);
+    } catch (e) {
+      // fall through
+    }
+    let purifiedDom = domPurify.sanitize(decodedDom);
     if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {
       purifiedDom = this.replace(purifiedDom);
     }
     purifiedDom = purifiedDom.replace(/(?:#|%23)$/, '')
       .replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/, '');
-    return encodeURI(purifiedDom);
+    try {
+      // prevent URIError caused by lone surrogates
+      return encodeURI(purifiedDom);
+    } catch (e) {
+      return purifiedDom;
+    }
   }
 
   /**
@@ -118,6 +143,8 @@ class URLSanitizer extends URISchemes {
    * @param {Array.<string>} [opt.allow] - array of allowed schemes
    * @param {Array.<string>} [opt.deny] - array of denied schemes
    * @param {Array.<string>} [opt.only] - array of specific schemes to allow
+   * @param {boolean} [opt.allowRelative] - allow relative URLs
+   * @param {boolean} [opt.debug] - enable debug mode
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt) {
@@ -125,7 +152,9 @@ class URLSanitizer extends URISchemes {
       this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
-    const { allow, deny, only } = opt ?? {};
+    const {
+      allow, deny, only, allowRelative = false, debug = false
+    } = opt ?? {};
     const schemeMap = new Map([
       ['blob', false],
       ['data', false],
@@ -151,7 +180,8 @@ class URLSanitizer extends URISchemes {
               try {
                 super.add(item);
               } catch (e) {
-                // fall through
+                const msg = `Failed to add scheme '${item}' in 'only' list.`;
+                logDebug(debug, msg, e);
               }
               if (super.has(item)) {
                 schemeMap.set(item, true);
@@ -177,7 +207,8 @@ class URLSanitizer extends URISchemes {
                 try {
                   super.add(item);
                 } catch (e) {
-                  // fall through
+                  const msg = `Failed to add scheme '${item}' in 'allow' list.`;
+                  logDebug(debug, msg, e);
                 }
                 if (super.has(item)) {
                   schemeMap.set(item, true);
@@ -201,25 +232,47 @@ class URLSanitizer extends URISchemes {
       }
     }
     let sanitizedUrl;
-    if (super.verify(url)) {
-      const { hash, href, pathname, protocol, search } = new URL(url);
-      const scheme = protocol.replace(/:$/, '');
-      const schemeParts = scheme.split('+');
-      let bool;
-      if (restrictScheme) {
-        bool = schemeParts.every(s => schemeMap.get(s));
+    let isVerified = super.verify(url);
+    let isRelative = false;
+    if (!isVerified && allowRelative) {
+      try {
+        const { hostname, protocol } = new URL(url, 'http://dummy.local');
+        if (protocol === 'http:' && hostname === 'dummy.local') {
+          isVerified = true;
+          isRelative = true;
+        }
+      } catch (e) {
+        logDebug(debug, 'Failed to parse relative URL.', e);
+      }
+    }
+    if (isVerified) {
+      let hash, href, pathname, protocol, search;
+      let scheme = '';
+      let schemeParts = [];
+      let bool = false;
+      if (isRelative) {
+        bool = true;
       } else {
-        for (const [key, value] of schemeMap.entries()) {
-          bool = value || (scheme !== key && schemeParts.every(s => s !== key));
-          if (!bool) {
-            break;
+        const urlObj = new URL(url);
+        ({ hash, href, pathname, protocol, search } = urlObj);
+        scheme = protocol.replace(/:$/, '');
+        schemeParts = scheme.split('+');
+        if (restrictScheme) {
+          bool = schemeParts.every(s => schemeMap.get(s));
+        } else {
+          for (const [key, value] of schemeMap.entries()) {
+            bool =
+              value || (scheme !== key && schemeParts.every(s => s !== key));
+            if (!bool) {
+              break;
+            }
           }
         }
       }
       if (bool) {
-        const isDataUrl = schemeParts.includes('data');
+        const isDataUrl = isRelative ? false : schemeParts.includes('data');
         let finalize;
-        let urlToSanitize = href;
+        let urlToSanitize = isRelative ? url : href;
         if (isDataUrl) {
           const [mediaType, ...dataParts] = pathname.split(',');
           const data = `${dataParts.join(',')}${search}${hash}`;
@@ -237,7 +290,8 @@ class URLSanitizer extends URISchemes {
               urlToSanitize = '';
             }
           } catch (e) {
-            // fall through
+            const msg = 'Failed to parse inner data URL protocol.';
+            logDebug(debug, msg, e);
           }
           const containsDataUrl = REG_DATA_URL.test(parsedData);
           if (parsedData !== data || containsDataUrl) {
@@ -383,8 +437,15 @@ const urlSanitizer = new URLSanitizer();
 export const sanitizeURL = async (url, opt = {
   allow: [],
   deny: [],
-  only: []
+  only: [],
+  allowRelative: false,
+  debug: false,
+  maxBlobSize: MAX_BLOB_SIZE
 }) => {
+  const isDebug = !!opt?.debug;
+  const maxBlobSize = Number.isInteger(opt?.maxBlobSize) && opt.maxBlobSize > 0
+    ? opt.maxBlobSize
+    : MAX_BLOB_SIZE;
   let res;
   if (url && isString(url)) {
     let scheme;
@@ -392,7 +453,7 @@ export const sanitizeURL = async (url, opt = {
       const { protocol } = new URL(url);
       scheme = protocol.replace(/:$/, '');
     } catch (e) {
-      // fall through;
+      logDebug(isDebug, `Invalid URL input format: ${url}`, e);
     }
     if (scheme === 'blob') {
       const { allow, deny, only } = opt;
@@ -401,10 +462,12 @@ export const sanitizeURL = async (url, opt = {
           (Array.isArray(only) && only.includes('blob'))) {
         let data;
         try {
-          data =
-            await fetch(url).then(r => r.blob()).then(createDataURLFromBlob);
+          data = await fetch(url)
+            .then(r => r.blob())
+            .then(b => createDataURLFromBlob(b, maxBlobSize));
         } catch (e) {
-          // fall through
+          const msg = `Failed to fetch and convert blob URL: ${url}`;
+          logDebug(isDebug, msg, e);
         }
         if (data) {
           if (Array.isArray(only)) {
@@ -424,7 +487,7 @@ export const sanitizeURL = async (url, opt = {
         }
       }
       URL.revokeObjectURL(url);
-    } else if (scheme) {
+    } else if (scheme || opt.allowRelative) {
       res = urlSanitizer.sanitize(url, opt);
     }
   }
@@ -450,11 +513,12 @@ export const sanitizeURLSync = (url, opt) => {
       const { protocol } = new URL(url);
       scheme = protocol.replace(/:$/, '');
     } catch (e) {
-      // fall through;
+      const msg = `Failed to parse URL: ${url}`;
+      logDebug(opt?.debug, msg, e);
     }
     if (scheme === 'blob') {
       URL.revokeObjectURL(url);
-    } else if (scheme) {
+    } else if (scheme || opt?.allowRelative) {
       res = urlSanitizer.sanitize(url, opt);
     }
   }

package/src/mjs/uri-util.js

@@ -8,7 +8,8 @@ import { FileReader } from './file-reader.js';
 import { textChars, uriSchemes } from './lib-util.js';
 
 import {
-  HEX, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT, REG_SCRIPT, REG_URL_ENC
+  HEX, MAX_BLOB_SIZE, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT,
+  REG_SCRIPT, REG_URL_ENC
 } from './constant.js';
 
 /**
@@ -128,15 +129,25 @@ export const parseURLEncodedNumCharRef = (str, nest = 0) => {
 /**
  * create data URL from blob
  * @param {object} blob - blob
+ * @param {number} maxBlobSize - max blob size
  * @returns {Promise.<?string>} - data URL
  */
-export const createDataURLFromBlob = blob => new Promise((resolve, reject) => {
-  const reader = new FileReader();
-  reader.addEventListener('error', () => reject(reader.error));
-  reader.addEventListener('abort', () => resolve(reader.result));
-  reader.addEventListener('load', () => resolve(reader.result));
-  reader.readAsDataURL(blob);
-});
+export const createDataURLFromBlob = (blob, maxBlobSize = MAX_BLOB_SIZE) =>
+  new Promise((resolve, reject) => {
+    if (!Number.isInteger(blob?.size)) {
+      return resolve(null);
+    } else if (Number.isInteger(maxBlobSize) && blob.size > maxBlobSize) {
+      return reject(new DOMException(
+        `Blob size (${blob.size} bytes) exceeds the maximum allowed size of ${maxBlobSize} bytes.`,
+        'NotReadableError'
+      ));
+    }
+    const reader = new FileReader();
+    reader.addEventListener('error', () => reject(reader.error));
+    reader.addEventListener('abort', () => resolve(reader.result));
+    reader.addEventListener('load', () => resolve(reader.result));
+    reader.readAsDataURL(blob);
+  });
 
 /**
  * URI schemes

package/types/mjs/constant.d.ts

@@ -1,4 +1,6 @@
+export const CHUNK_SIZE: number;
 export const HEX: 16;
+export const MAX_BLOB_SIZE: number;
 export const TYPE_FROM: 8;
 export const TYPE_TO: -1;
 export const REG_B64: RegExp;

package/types/mjs/sanitizer.d.ts

@@ -1,3 +1,4 @@
+export function logDebug(isDebug: boolean, message: string, error?: Error): void;
 export function sanitizeURL(url: string, opt?: {
     allow?: string[] | undefined;
     deny?: string[] | undefined;
@@ -40,6 +41,8 @@ export class URLSanitizer extends URISchemes {
         allow?: string[] | undefined;
         deny?: string[] | undefined;
         only?: string[] | undefined;
+        allowRelative?: boolean | undefined;
+        debug?: boolean | undefined;
     }): string | null;
     parse(url: string, opt?: {
         allow?: string[] | undefined;

package/types/mjs/uri-util.d.ts

@@ -2,7 +2,7 @@ export function getURLEncodedString(str: string): string;
 export function escapeURLEncodedHTMLChars(ch: string): string;
 export function parseBase64(data: string): string;
 export function parseURLEncodedNumCharRef(str: string, nest?: number): string;
-export function createDataURLFromBlob(blob: object): Promise<string | null>;
+export function createDataURLFromBlob(blob: object, maxBlobSize?: number): Promise<string | null>;
 export class URISchemes {
     get(): Array<string>;
     has(scheme: string): boolean;