url-sanitizer 2.2.0 → 2.3.0

package/package.json

@@ -29,6 +29,7 @@
     "jsdom": "^29.1.1"
   },
   "devDependencies": {
+    "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^25.8.0",
     "c8": "^11.0.0",
@@ -40,13 +41,16 @@
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-regexp": "^3.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
+    "fast-check": "^4.8.0",
     "globals": "^17.6.0",
     "http-server": "^14.1.1",
+    "mitata": "^1.0.34",
     "mocha": "^11.7.5",
     "neostandard": "^0.13.0",
     "npm-run-all2": "^8.0.4",
     "papaparse": "^5.5.3",
     "sinon": "^22.0.0",
+    "strict-url-sanitise": "^0.0.1",
     "typescript": "^6.0.3",
     "undici": "^8.0.2"
   },
@@ -63,6 +67,7 @@
     "serialize-javascript": "^7.0.4"
   },
   "scripts": {
+    "bench": "node benchmark/benchmark.js",
     "build": "npm run include && npm run tsc && npm run lint && npm test && npm run copy && npm run bundle",
     "bundle": "npm-run-all -s bundle:*",
     "bundle:min": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer.min.js --bundle --minify --sourcemap bundle/index.js",
@@ -79,5 +84,5 @@
     "test:bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
-  "version": "2.2.0"
+  "version": "2.3.0"
 }

package/src/mjs/sanitizer.js

@@ -111,13 +111,26 @@ class URLSanitizer extends URISchemes {
     if (!isString(dom)) {
       throw new TypeError(`Expected String but got ${getType(dom)}.`);
     }
-    let purifiedDom = domPurify.sanitize(decodeURIComponent(dom));
+    let decodedDom = dom;
+    try {
+      // prevent URIError caused by malformed percent-encoding
+      // e.g., a standalone '%'
+      decodedDom = decodeURIComponent(dom);
+    } catch (e) {
+      // fall through
+    }
+    let purifiedDom = domPurify.sanitize(decodedDom);
     if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {
       purifiedDom = this.replace(purifiedDom);
     }
     purifiedDom = purifiedDom.replace(/(?:#|%23)$/, '')
       .replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/, '');
-    return encodeURI(purifiedDom);
+    try {
+      // prevent URIError caused by lone surrogates
+      return encodeURI(purifiedDom);
+    } catch (e) {
+      return purifiedDom;
+    }
   }
 
   /**
@@ -130,6 +143,8 @@ class URLSanitizer extends URISchemes {
    * @param {Array.<string>} [opt.allow] - array of allowed schemes
    * @param {Array.<string>} [opt.deny] - array of denied schemes
    * @param {Array.<string>} [opt.only] - array of specific schemes to allow
+   * @param {boolean} [opt.allowRelative] - allow relative URLs
+   * @param {boolean} [opt.debug] - enable debug mode
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt) {
@@ -137,7 +152,9 @@ class URLSanitizer extends URISchemes {
       this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
-    const { allow, deny, only, debug = false } = opt ?? {};
+    const {
+      allow, deny, only, allowRelative = false, debug = false
+    } = opt ?? {};
     const schemeMap = new Map([
       ['blob', false],
       ['data', false],
@@ -215,25 +232,47 @@ class URLSanitizer extends URISchemes {
       }
     }
     let sanitizedUrl;
-    if (super.verify(url)) {
-      const { hash, href, pathname, protocol, search } = new URL(url);
-      const scheme = protocol.replace(/:$/, '');
-      const schemeParts = scheme.split('+');
-      let bool;
-      if (restrictScheme) {
-        bool = schemeParts.every(s => schemeMap.get(s));
+    let isVerified = super.verify(url);
+    let isRelative = false;
+    if (!isVerified && allowRelative) {
+      try {
+        const { hostname, protocol } = new URL(url, 'http://dummy.local');
+        if (protocol === 'http:' && hostname === 'dummy.local') {
+          isVerified = true;
+          isRelative = true;
+        }
+      } catch (e) {
+        logDebug(debug, 'Failed to parse relative URL.', e);
+      }
+    }
+    if (isVerified) {
+      let hash, href, pathname, protocol, search;
+      let scheme = '';
+      let schemeParts = [];
+      let bool = false;
+      if (isRelative) {
+        bool = true;
       } else {
-        for (const [key, value] of schemeMap.entries()) {
-          bool = value || (scheme !== key && schemeParts.every(s => s !== key));
-          if (!bool) {
-            break;
+        const urlObj = new URL(url);
+        ({ hash, href, pathname, protocol, search } = urlObj);
+        scheme = protocol.replace(/:$/, '');
+        schemeParts = scheme.split('+');
+        if (restrictScheme) {
+          bool = schemeParts.every(s => schemeMap.get(s));
+        } else {
+          for (const [key, value] of schemeMap.entries()) {
+            bool =
+              value || (scheme !== key && schemeParts.every(s => s !== key));
+            if (!bool) {
+              break;
+            }
           }
         }
       }
       if (bool) {
-        const isDataUrl = schemeParts.includes('data');
+        const isDataUrl = isRelative ? false : schemeParts.includes('data');
         let finalize;
-        let urlToSanitize = href;
+        let urlToSanitize = isRelative ? url : href;
         if (isDataUrl) {
           const [mediaType, ...dataParts] = pathname.split(',');
           const data = `${dataParts.join(',')}${search}${hash}`;
@@ -399,6 +438,7 @@ export const sanitizeURL = async (url, opt = {
   allow: [],
   deny: [],
   only: [],
+  allowRelative: false,
   debug: false,
   maxBlobSize: MAX_BLOB_SIZE
 }) => {
@@ -447,7 +487,7 @@ export const sanitizeURL = async (url, opt = {
         }
       }
       URL.revokeObjectURL(url);
-    } else if (scheme) {
+    } else if (scheme || opt.allowRelative) {
       res = urlSanitizer.sanitize(url, opt);
     }
   }
@@ -478,7 +518,7 @@ export const sanitizeURLSync = (url, opt) => {
     }
     if (scheme === 'blob') {
       URL.revokeObjectURL(url);
-    } else if (scheme) {
+    } else if (scheme || opt?.allowRelative) {
       res = urlSanitizer.sanitize(url, opt);
     }
   }

package/types/mjs/sanitizer.d.ts

@@ -41,6 +41,8 @@ export class URLSanitizer extends URISchemes {
         allow?: string[] | undefined;
         deny?: string[] | undefined;
         only?: string[] | undefined;
+        allowRelative?: boolean | undefined;
+        debug?: boolean | undefined;
     }): string | null;
     parse(url: string, opt?: {
         allow?: string[] | undefined;