url-sanitizer 2.2.0 → 2.3.1

package/package.json

@@ -29,6 +29,7 @@
     "jsdom": "^29.1.1"
   },
   "devDependencies": {
+    "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^25.8.0",
     "c8": "^11.0.0",
@@ -40,13 +41,16 @@
     "eslint-plugin-jsdoc": "^62.9.0",
     "eslint-plugin-regexp": "^3.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
+    "fast-check": "^4.8.0",
     "globals": "^17.6.0",
     "http-server": "^14.1.1",
+    "mitata": "^1.0.34",
     "mocha": "^11.7.5",
     "neostandard": "^0.13.0",
     "npm-run-all2": "^8.0.4",
     "papaparse": "^5.5.3",
     "sinon": "^22.0.0",
+    "strict-url-sanitise": "^0.0.1",
     "typescript": "^6.0.3",
     "undici": "^8.0.2"
   },
@@ -63,6 +67,7 @@
     "serialize-javascript": "^7.0.4"
   },
   "scripts": {
+    "bench": "node benchmark/benchmark.js",
     "build": "npm run include && npm run tsc && npm run lint && npm test && npm run copy && npm run bundle",
     "bundle": "npm-run-all -s bundle:*",
     "bundle:min": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer.min.js --bundle --minify --sourcemap bundle/index.js",
@@ -79,5 +84,5 @@
     "test:bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
-  "version": "2.2.0"
+  "version": "2.3.1"
 }

package/src/mjs/sanitizer.js

@@ -84,9 +84,15 @@ class URLSanitizer extends URISchemes {
         }
         this.#nest++;
         this.#recurse.add(dataUrl);
-        const parsedDataUrl = this.sanitize(dataUrl, {
-          allow: ['data']
-        });
+        let parsedDataUrl;
+        try {
+          parsedDataUrl = this.sanitize(dataUrl, {
+            allow: ['data']
+          });
+        } finally {
+          this.#nest--;
+          this.#recurse.delete(dataUrl);
+        }
         const { index } = item;
         const [preDataUrl, postDataUrl] = [
           replacedData.substring(0, index),
@@ -111,13 +117,26 @@ class URLSanitizer extends URISchemes {
     if (!isString(dom)) {
       throw new TypeError(`Expected String but got ${getType(dom)}.`);
     }
-    let purifiedDom = domPurify.sanitize(decodeURIComponent(dom));
+    let decodedDom = dom;
+    try {
+      // prevent URIError caused by malformed percent-encoding
+      // e.g., a standalone '%'
+      decodedDom = decodeURIComponent(dom);
+    } catch (e) {
+      // fall through
+    }
+    let purifiedDom = domPurify.sanitize(decodedDom);
     if (purifiedDom && REG_DATA_URL.test(purifiedDom)) {
       purifiedDom = this.replace(purifiedDom);
     }
     purifiedDom = purifiedDom.replace(/(?:#|%23)$/, '')
       .replace(/(?<!(?:#|%23).*)(?:\?|%3F)$/, '');
-    return encodeURI(purifiedDom);
+    try {
+      // prevent URIError caused by lone surrogates
+      return encodeURI(purifiedDom);
+    } catch (e) {
+      return purifiedDom;
+    }
   }
 
   /**
@@ -130,19 +149,22 @@ class URLSanitizer extends URISchemes {
    * @param {Array.<string>} [opt.allow] - array of allowed schemes
    * @param {Array.<string>} [opt.deny] - array of denied schemes
    * @param {Array.<string>} [opt.only] - array of specific schemes to allow
+   * @param {boolean} [opt.allowRelative] - allow relative URLs
+   * @param {boolean} [opt.debug] - enable debug mode
    * @returns {?string} - sanitized URL
    */
   sanitize(url, opt) {
     if (this.#nest > HEX) {
-      this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
-    const { allow, deny, only, debug = false } = opt ?? {};
+    const {
+      allow, deny, only, allowRelative = false, debug = false
+    } = opt ?? {};
     const schemeMap = new Map([
       ['blob', false],
       ['data', false],
       ['file', false],
-      ['javascrpt', false],
+      ['javascript', false],
       ['vbscript', false]
     ]);
     const tempScheme = new Set();
@@ -215,25 +237,46 @@ class URLSanitizer extends URISchemes {
       }
     }
     let sanitizedUrl;
-    if (super.verify(url)) {
-      const { hash, href, pathname, protocol, search } = new URL(url);
-      const scheme = protocol.replace(/:$/, '');
-      const schemeParts = scheme.split('+');
-      let bool;
-      if (restrictScheme) {
-        bool = schemeParts.every(s => schemeMap.get(s));
+    let isVerified = super.verify(url);
+    let isRelative = false;
+    if (!isVerified && allowRelative) {
+      try {
+        const { hostname, protocol } = new URL(url, 'http://dummy.local');
+        if (protocol === 'http:' && hostname === 'dummy.local') {
+          isVerified = true;
+          isRelative = true;
+        }
+      } catch (e) {
+        logDebug(debug, 'Failed to parse relative URL.', e);
+      }
+    }
+    if (isVerified) {
+      let hash, href, pathname, protocol, search;
+      let scheme = '';
+      let schemeParts = [];
+      let bool = false;
+      if (isRelative) {
+        bool = true;
       } else {
-        for (const [key, value] of schemeMap.entries()) {
-          bool = value || (scheme !== key && schemeParts.every(s => s !== key));
-          if (!bool) {
-            break;
+        const urlObj = new URL(url);
+        ({ hash, href, pathname, protocol, search } = urlObj);
+        scheme = protocol.replace(/:$/, '');
+        schemeParts = scheme.split('+');
+        if (restrictScheme) {
+          bool = schemeParts.every(s => schemeMap.get(s));
+        } else {
+          for (const [key, value] of schemeMap.entries()) {
+            bool =
+              value || (scheme !== key && schemeParts.every(s => s !== key));
+            if (!bool) {
+              break;
+            }
           }
         }
       }
       if (bool) {
-        const isDataUrl = schemeParts.includes('data');
-        let finalize;
-        let urlToSanitize = href;
+        const isDataUrl = isRelative ? false : schemeParts.includes('data');
+        let urlToSanitize = isRelative ? url : href;
         if (isDataUrl) {
           const [mediaType, ...dataParts] = pathname.split(',');
           const data = `${dataParts.join(',')}${search}${hash}`;
@@ -258,15 +301,7 @@ class URLSanitizer extends URISchemes {
           if (parsedData !== data || containsDataUrl) {
             if (containsDataUrl) {
               parsedData = this.replace(parsedData);
-            } else if (this.#recurse.has(url)) {
-              this.#recurse.delete(url);
-            } else {
-              finalize = true;
             }
-          } else if (this.#recurse.has(url)) {
-            this.#recurse.delete(url);
-          } else {
-            finalize = true;
           }
           if (!mediaType || REG_MIME_DOM.test(mediaType)) {
             parsedData = this.purify(parsedData);
@@ -279,8 +314,6 @@ class URLSanitizer extends URISchemes {
           } else {
             urlToSanitize = '';
           }
-        } else {
-          finalize = true;
         }
         if (!isDataUrl && REG_TAG_QUOT.test(urlToSanitize)) {
           const item = REG_TAG_QUOT.exec(urlToSanitize);
@@ -291,11 +324,6 @@ class URLSanitizer extends URISchemes {
         if (urlToSanitize) {
           sanitizedUrl =
             urlToSanitize.replace(/%26/g, escapeURLEncodedHTMLChars);
-          if (finalize) {
-            this.#nest = 0;
-          }
-        } else {
-          this.#nest = 0;
         }
       }
       if (tempScheme.size) {
@@ -399,6 +427,7 @@ export const sanitizeURL = async (url, opt = {
   allow: [],
   deny: [],
   only: [],
+  allowRelative: false,
   debug: false,
   maxBlobSize: MAX_BLOB_SIZE
 }) => {
@@ -447,7 +476,7 @@ export const sanitizeURL = async (url, opt = {
         }
       }
       URL.revokeObjectURL(url);
-    } else if (scheme) {
+    } else if (scheme || opt.allowRelative) {
       res = urlSanitizer.sanitize(url, opt);
     }
   }
@@ -478,7 +507,7 @@ export const sanitizeURLSync = (url, opt) => {
     }
     if (scheme === 'blob') {
       URL.revokeObjectURL(url);
-    } else if (scheme) {
+    } else if (scheme || opt?.allowRelative) {
       res = urlSanitizer.sanitize(url, opt);
     }
   }

package/types/mjs/sanitizer.d.ts

@@ -41,6 +41,8 @@ export class URLSanitizer extends URISchemes {
         allow?: string[] | undefined;
         deny?: string[] | undefined;
         only?: string[] | undefined;
+        allowRelative?: boolean | undefined;
+        debug?: boolean | undefined;
     }): string | null;
     parse(url: string, opt?: {
         allow?: string[] | undefined;