url-sanitizer 2.3.0 → 3.0.0

package/package.json

@@ -25,29 +25,28 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "dompurify": "^3.4.3",
+    "dompurify": "^3.4.5",
     "jsdom": "^29.1.1"
   },
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^28.0.3",
-    "@types/node": "^25.8.0",
+    "@types/node": "^25.9.1",
     "c8": "^11.0.0",
     "chai": "^6.2.2",
     "commander": "^14.0.3",
     "copyfiles-ng": "^2.4.7",
     "esbuild": "^0.28.0",
     "eslint": "^9.39.4",
-    "eslint-plugin-jsdoc": "^62.9.0",
+    "eslint-plugin-jsdoc": "^63.0.0",
     "eslint-plugin-regexp": "^3.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "fast-check": "^4.8.0",
     "globals": "^17.6.0",
     "http-server": "^14.1.1",
     "mitata": "^1.0.34",
-    "mocha": "^11.7.5",
+    "mocha": "^11.7.6",
     "neostandard": "^0.13.0",
-    "npm-run-all2": "^8.0.4",
     "papaparse": "^5.5.3",
     "sinon": "^22.0.0",
     "strict-url-sanitise": "^0.0.1",
@@ -69,20 +68,23 @@
   "scripts": {
     "bench": "node benchmark/benchmark.js",
     "build": "npm run include && npm run tsc && npm run lint && npm test && npm run copy && npm run bundle",
-    "bundle": "npm-run-all -s bundle:*",
+    "bundle": "npm run bundle:min && npm run bundle:min-wo-dompurify",
     "bundle:min": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer.min.js --bundle --minify --sourcemap bundle/index.js",
     "bundle:min-wo-dompurify": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer-wo-dompurify.min.js --bundle --minify --sourcemap bundle_wo_dompurify/index.js",
     "char": "node scripts/index char -i",
-    "copy": "npm-run-all -s copy:*",
-    "copy:src": "copyfiles-ng src/**/* bundle --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js --exclude=src/mjs/lib-util.js",
-    "copy:src-wo-dompurify": "copyfiles-ng src/**/* bundle_wo_dompurify --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js --exclude=src/mjs/lib-util.js",
-    "copy:repl": "copyfiles-ng repl/dompurify.js repl/file-reader.js repl/lib-util.js bundle/mjs --up=1 --verbose",
-    "copy:repl-wo-dompurify": "copyfiles-ng repl/dompurify-global.js repl/file-reader.js repl/lib-util.js bundle_wo_dompurify/mjs --up=1 --verbose && node scripts/index rename --oldpath=bundle_wo_dompurify/mjs/dompurify-global.js --newpath=bundle_wo_dompurify/mjs/dompurify.js -i",
+    "copy": "npm run copy:src && npm run copy:src-wo-dompurify && npm run copy:repl && npm run copy:repl-wo-dompurify",
+    "copy:src": "copyfiles-ng src/**/* bundle --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js",
+    "copy:src-wo-dompurify": "copyfiles-ng src/**/* bundle_wo_dompurify --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js",
+    "copy:repl": "copyfiles-ng repl/dompurify.js repl/file-reader.js bundle/mjs --up=1 --verbose",
+    "copy:repl-wo-dompurify": "copyfiles-ng repl/dompurify-global.js repl/file-reader.js bundle_wo_dompurify/mjs --up=1 --verbose && node scripts/index rename --oldpath=bundle_wo_dompurify/mjs/dompurify-global.js --newpath=bundle_wo_dompurify/mjs/dompurify.js -i",
     "include": "node scripts/index include --dir=iana -i",
     "lint": "eslint --fix .",
     "test": "c8 --reporter=text mocha --exit test/*.test.js",
     "test:bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
-  "version": "2.3.0"
+  "engines": {
+    "node": ">=22"
+  },
+  "version": "3.0.0"
 }

package/src/mjs/file-reader.js

@@ -3,8 +3,8 @@
  */
 
 /* shared */
+import textChars from '../lib/file/text-chars.json' with { type: 'json' };
 import { getType, isString } from './common.js';
-import { textChars } from './lib-util.js';
 
 /* constants */
 import {
@@ -103,19 +103,17 @@ export class FileReader extends EventTarget {
    * @returns {boolean} - result
    */
   _dispatchProgressEvent(type) {
-    if (isString(type)) {
-      type = type.trim();
-      if (!/abort|error|load(?:end|start)?|progress/.test(type)) {
-        this.#error = new DOMException('Invalid state.', 'InvalidStateError');
-        this._dispatchProgressEvent('error');
-        throw this.#error;
-      }
-    } else {
+    if (!isString(type)) {
       this.#error = new TypeError(`Expected String but got ${getType(type)}.`);
       this._dispatchProgressEvent('error');
       throw this.#error;
     }
-    if (type === 'error' && !this.#error) {
+    type = type.trim();
+    if (!/abort|error|load(?:end|start)?|progress/.test(type)) {
+      this.#error = new DOMException('Invalid state.', 'InvalidStateError');
+      this._dispatchProgressEvent('error');
+      throw this.#error;
+    } else if (type === 'error' && !this.#error) {
       this.#error = new Error('Unknown error.');
     }
     const evt = new ProgressEvent(type, {
@@ -132,9 +130,15 @@ export class FileReader extends EventTarget {
    * @returns {void}
    */
   abort() {
+    if (this.#state === this.EMPTY || this.#state === this.DONE) {
+      this.#result = null;
+      return;
+    }
     this.#state = this.DONE;
     this.#result = null;
     this.#terminate = true;
+    this.#error =
+      new DOMException('The read operation was aborted.', 'AbortError');
     this._dispatchProgressEvent('abort');
     this._dispatchProgressEvent('loadend');
   }
@@ -147,8 +151,14 @@ export class FileReader extends EventTarget {
    * @returns {Promise.<void>} - void
    */
   async _read(blob, format, encoding = '') {
-    if (!(blob instanceof Blob && isString(format) && isString(encoding))) {
-      this.abort();
+    if (!(blob instanceof Blob)) {
+      throw new TypeError(`Expected Blob but got ${getType(blob)}.`);
+    }
+    if (!isString(format)) {
+      throw new TypeError(`Expected String but got ${getType(format)}.`);
+    }
+    if (!isString(encoding)) {
+      throw new TypeError(`Expected String but got ${getType(encoding)}.`);
     }
     if (!this.#terminate) {
       if (this.#state === this.LOADING) {

package/src/mjs/sanitizer.js

@@ -64,6 +64,35 @@ class URLSanitizer extends URISchemes {
     this.#nest = 0;
   }
 
+  /**
+   * helper to register schemes for allow/only options
+   * @private
+   * @param {string} item - scheme to register
+   * @param {string} listName - name of the option list
+   * @param {object} ctx - local context for state management
+   * @returns {boolean} - true if scheme is acceptable
+   */
+  #registerScheme(item, listName, ctx) {
+    if (!REG_SCRIPT_BLOB.test(item)) {
+      if (super.has(item)) {
+        ctx.schemeMap.set(item, true);
+      } else {
+        try {
+          super.add(item);
+        } catch (e) {
+          const msg = `Failed to add scheme '${item}' in '${listName}' list.`;
+          logDebug(ctx.debug, msg, e);
+        }
+        if (super.has(item)) {
+          ctx.schemeMap.set(item, true);
+          ctx.tempScheme.add(item);
+        }
+      }
+      return true;
+    }
+    return false;
+  }
+
   /**
    * replace matched data URLs
    * @param {string} data - data URL
@@ -84,9 +113,15 @@ class URLSanitizer extends URISchemes {
         }
         this.#nest++;
         this.#recurse.add(dataUrl);
-        const parsedDataUrl = this.sanitize(dataUrl, {
-          allow: ['data']
-        });
+        let parsedDataUrl;
+        try {
+          parsedDataUrl = this.sanitize(dataUrl, {
+            allow: ['data']
+          });
+        } finally {
+          this.#nest--;
+          this.#recurse.delete(dataUrl);
+        }
         const { index } = item;
         const [preDataUrl, postDataUrl] = [
           replacedData.substring(0, index),
@@ -149,7 +184,6 @@ class URLSanitizer extends URISchemes {
    */
   sanitize(url, opt) {
     if (this.#nest > HEX) {
-      this.#nest = 0;
       throw new Error('Data URLs nested too deeply.');
     }
     const {
@@ -159,69 +193,36 @@ class URLSanitizer extends URISchemes {
       ['blob', false],
       ['data', false],
       ['file', false],
-      ['javascrpt', false],
+      ['javascript', false],
       ['vbscript', false]
     ]);
     const tempScheme = new Set();
+    const ctx = { schemeMap, tempScheme, debug };
     let restrictScheme = false;
     if (Array.isArray(only) && only.length) {
       const schemes = super.get();
       for (const item of schemes) {
         schemeMap.set(item, false);
       }
-      const items = Object.values(only);
-      for (let item of items) {
+      for (let item of only) {
         if (isString(item)) {
           item = item.trim();
-          if (!REG_SCRIPT_BLOB.test(item)) {
-            if (super.has(item)) {
-              schemeMap.set(item, true);
-            } else {
-              try {
-                super.add(item);
-              } catch (e) {
-                const msg = `Failed to add scheme '${item}' in 'only' list.`;
-                logDebug(debug, msg, e);
-              }
-              if (super.has(item)) {
-                schemeMap.set(item, true);
-                tempScheme.add(item);
-              }
-            }
-            if (!restrictScheme && schemeMap.has(item)) {
-              restrictScheme = schemeMap.get(item);
-            }
+          const registered = this.#registerScheme(item, 'only', ctx);
+          if (registered && !restrictScheme && schemeMap.has(item)) {
+            restrictScheme = schemeMap.get(item);
           }
         }
       }
     } else {
       if (Array.isArray(allow) && allow.length) {
-        const items = Object.values(allow);
-        for (let item of items) {
+        for (const item of allow) {
           if (isString(item)) {
-            item = item.trim();
-            if (!REG_SCRIPT_BLOB.test(item)) {
-              if (super.has(item)) {
-                schemeMap.set(item, true);
-              } else {
-                try {
-                  super.add(item);
-                } catch (e) {
-                  const msg = `Failed to add scheme '${item}' in 'allow' list.`;
-                  logDebug(debug, msg, e);
-                }
-                if (super.has(item)) {
-                  schemeMap.set(item, true);
-                  tempScheme.add(item);
-                }
-              }
-            }
+            this.#registerScheme(item.trim(), 'allow', ctx);
           }
         }
       }
       if (Array.isArray(deny) && deny.length) {
-        const items = Object.values(deny);
-        for (let item of items) {
+        for (let item of deny) {
           if (isString(item)) {
             item = item.trim();
             if (item) {
@@ -271,7 +272,6 @@ class URLSanitizer extends URISchemes {
       }
       if (bool) {
         const isDataUrl = isRelative ? false : schemeParts.includes('data');
-        let finalize;
         let urlToSanitize = isRelative ? url : href;
         if (isDataUrl) {
           const [mediaType, ...dataParts] = pathname.split(',');
@@ -297,15 +297,7 @@ class URLSanitizer extends URISchemes {
           if (parsedData !== data || containsDataUrl) {
             if (containsDataUrl) {
               parsedData = this.replace(parsedData);
-            } else if (this.#recurse.has(url)) {
-              this.#recurse.delete(url);
-            } else {
-              finalize = true;
             }
-          } else if (this.#recurse.has(url)) {
-            this.#recurse.delete(url);
-          } else {
-            finalize = true;
           }
           if (!mediaType || REG_MIME_DOM.test(mediaType)) {
             parsedData = this.purify(parsedData);
@@ -318,8 +310,6 @@ class URLSanitizer extends URISchemes {
           } else {
             urlToSanitize = '';
           }
-        } else {
-          finalize = true;
         }
         if (!isDataUrl && REG_TAG_QUOT.test(urlToSanitize)) {
           const item = REG_TAG_QUOT.exec(urlToSanitize);
@@ -330,11 +320,6 @@ class URLSanitizer extends URISchemes {
         if (urlToSanitize) {
           sanitizedUrl =
             urlToSanitize.replace(/%26/g, escapeURLEncodedHTMLChars);
-          if (finalize) {
-            this.#nest = 0;
-          }
-        } else {
-          this.#nest = 0;
         }
       }
       if (tempScheme.size) {

package/src/mjs/uri-util.js

@@ -3,10 +3,12 @@
  */
 
 /* shared */
+import textChars from '../lib/file/text-chars.json' with { type: 'json' };
+import uriSchemes from '../lib/iana/uri-schemes.json' with { type: 'json' };
 import { getType, isString } from './common.js';
 import { FileReader } from './file-reader.js';
-import { textChars, uriSchemes } from './lib-util.js';
 
+/* constants */
 import {
   HEX, MAX_BLOB_SIZE, REG_B64, REG_NUM_REF, REG_SCHEME, REG_SCHEME_EXT,
   REG_SCRIPT, REG_URL_ENC
@@ -154,14 +156,7 @@ export const createDataURLFromBlob = (blob, maxBlobSize = MAX_BLOB_SIZE) =>
  */
 export class URISchemes {
   /* private fields */
-  #schemes;
-
-  /**
-   * construct
-   */
-  constructor() {
-    this.#schemes = new Set(uriSchemes);
-  }
+  #schemes = new Set(uriSchemes);
 
   /**
    * get schemes
@@ -234,9 +229,6 @@ export class URISchemes {
    * @returns {void}
    */
   reset() {
-    this.#schemes.clear();
-    for (const scheme of uriSchemes) {
-      this.#schemes.add(scheme);
-    }
+    this.#schemes = new Set(uriSchemes);
   }
 }

package/src/mjs/lib-util.js

@@ -1,37 +0,0 @@
-/**
- * lib-util.js
- */
-
-import fs from 'node:fs';
-import { fileURLToPath } from 'node:url';
-
-/* constants */
-const CHAR = 'utf8';
-
-/**
- * parse json
- * @param {string} url - file url
- * @returns {string|Array|object} - parsed json
- */
-export const parseJson = url => {
-  const { href } = new URL(url, import.meta.url);
-  const filePath = fileURLToPath(href);
-  const file = fs.readFileSync(filePath, {
-    encoding: CHAR,
-    flag: 'r'
-  });
-  const content = JSON.parse(file);
-  return content;
-};
-
-/**
- * text chars
- * @type {Array.<number>}
- */
-export const textChars = parseJson('../lib/file/text-chars.json');
-
-/**
- * uri schemes
- * @type {Array.<string>}
- */
-export const uriSchemes = parseJson('../lib/iana/uri-schemes.json');

package/types/mjs/lib-util.d.ts

@@ -1,3 +0,0 @@
-export function parseJson(url: string): string | any[] | object;
-export const textChars: Array<number>;
-export const uriSchemes: Array<string>;