url-sanitizer 2.3.1 → 4.0.0

package/package.json

@@ -19,35 +19,34 @@
   "exports": {
     ".": {
       "types": "./types/index.d.ts",
-      "browser": "./dist/url-sanitizer-wo-dompurify.min.js",
+      "browser": "./dist/url-sanitizer.min.js",
       "default": "./src/index.js"
     },
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "dompurify": "^3.4.3",
+    "dompurify": "^3.4.7",
     "jsdom": "^29.1.1"
   },
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^28.0.3",
-    "@types/node": "^25.8.0",
+    "@types/node": "^25.9.1",
     "c8": "^11.0.0",
     "chai": "^6.2.2",
-    "commander": "^14.0.3",
+    "commander": "^15.0.0",
     "copyfiles-ng": "^2.4.7",
     "esbuild": "^0.28.0",
     "eslint": "^9.39.4",
-    "eslint-plugin-jsdoc": "^62.9.0",
+    "eslint-plugin-jsdoc": "^63.0.0",
     "eslint-plugin-regexp": "^3.1.0",
     "eslint-plugin-unicorn": "^64.0.0",
     "fast-check": "^4.8.0",
     "globals": "^17.6.0",
     "http-server": "^14.1.1",
     "mitata": "^1.0.34",
-    "mocha": "^11.7.5",
+    "mocha": "^11.7.6",
     "neostandard": "^0.13.0",
-    "npm-run-all2": "^8.0.4",
     "papaparse": "^5.5.3",
     "sinon": "^22.0.0",
     "strict-url-sanitise": "^0.0.1",
@@ -69,20 +68,23 @@
   "scripts": {
     "bench": "node benchmark/benchmark.js",
     "build": "npm run include && npm run tsc && npm run lint && npm test && npm run copy && npm run bundle",
-    "bundle": "npm-run-all -s bundle:*",
+    "bundle": "npm run bundle:min && npm run bundle:min-wo-dompurify",
     "bundle:min": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer.min.js --bundle --minify --sourcemap bundle/index.js",
     "bundle:min-wo-dompurify": "esbuild --format=esm --platform=browser --outfile=dist/url-sanitizer-wo-dompurify.min.js --bundle --minify --sourcemap bundle_wo_dompurify/index.js",
     "char": "node scripts/index char -i",
-    "copy": "npm-run-all -s copy:*",
-    "copy:src": "copyfiles-ng src/**/* bundle --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js --exclude=src/mjs/lib-util.js",
-    "copy:src-wo-dompurify": "copyfiles-ng src/**/* bundle_wo_dompurify --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js --exclude=src/mjs/lib-util.js",
-    "copy:repl": "copyfiles-ng repl/dompurify.js repl/file-reader.js repl/lib-util.js bundle/mjs --up=1 --verbose",
-    "copy:repl-wo-dompurify": "copyfiles-ng repl/dompurify-global.js repl/file-reader.js repl/lib-util.js bundle_wo_dompurify/mjs --up=1 --verbose && node scripts/index rename --oldpath=bundle_wo_dompurify/mjs/dompurify-global.js --newpath=bundle_wo_dompurify/mjs/dompurify.js -i",
+    "copy": "npm run copy:src && npm run copy:src-wo-dompurify && npm run copy:repl && npm run copy:repl-wo-dompurify",
+    "copy:src": "copyfiles-ng src/**/* bundle --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js",
+    "copy:src-wo-dompurify": "copyfiles-ng src/**/* bundle_wo_dompurify --up=1 --verbose --exclude=src/mjs/dompurify.js --exclude=src/mjs/file-reader.js",
+    "copy:repl": "copyfiles-ng repl/dompurify.js repl/file-reader.js bundle/mjs --up=1 --verbose",
+    "copy:repl-wo-dompurify": "copyfiles-ng repl/dompurify-global.js repl/file-reader.js bundle_wo_dompurify/mjs --up=1 --verbose && node scripts/index rename --oldpath=bundle_wo_dompurify/mjs/dompurify-global.js --newpath=bundle_wo_dompurify/mjs/dompurify.js -i",
     "include": "node scripts/index include --dir=iana -i",
     "lint": "eslint --fix .",
     "test": "c8 --reporter=text mocha --exit test/*.test.js",
     "test:bdd": "http-server ./ -c-1 -o test/bdd/url-sanitizer.test.html",
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
-  "version": "2.3.1"
+  "engines": {
+    "node": ">=22.13"
+  },
+  "version": "4.0.0"
 }

package/src/lib/file/text-chars.json

@@ -1 +1 @@
-[7,8,9,10,11,12,13,27,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255]
+[7,8,9,10,11,12,13,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255]

package/src/mjs/common.js

@@ -6,16 +6,17 @@
 import { TYPE_FROM, TYPE_TO } from './constant.js';
 
 /**
- * get type
- * @param {object} o - object to check
- * @returns {string} - type of object
+ * Gets the type of the given object.
+ * Returns the object class name (e.g., "String", "Array", "Null", "Undefined").
+ * @param {unknown} o - The object to check.
+ * @returns {string} The specific type of the object.
  */
 export const getType = o =>
   Object.prototype.toString.call(o).slice(TYPE_FROM, TYPE_TO);
 
 /**
- * is string
- * @param {object} o - object to check
- * @returns {boolean} - result
+ * Checks if the given value is a string.
+ * @param {unknown} o - The value to check.
+ * @returns {boolean} True if the value is a string, false otherwise.
  */
 export const isString = o => typeof o === 'string' || o instanceof String;

package/src/mjs/constant.js

@@ -2,26 +2,46 @@
  * constant.js
  */
 
-/* numeric */
+/**
+ * The chunk size in bytes (8KB) used for processing data arrays to prevent stack overflow.
+ * @type {number}
+ */
 export const CHUNK_SIZE = 8 * 1024;
+
+/**
+ * The radix used for decimal string conversions and calculations.
+ * @type {number}
+ */
+export const DECI = 10;
+
+/**
+ * The radix used for hexadecimal string conversions and calculations.
+ * @type {number}
+ */
 export const HEX = 16;
-export const MAX_BLOB_SIZE = 32 * 1024 * 1024;
+
+/**
+ * The maximum allowed size for a Blob in bytes (16MB).
+ * @type {number}
+ */
+export const MAX_BLOB_SIZE = 16 * 1024 * 1024;
+
+/**
+ * The maximum allowed nesting depth for recurse.
+ * @type {number}
+ */
+export const MAX_NEST = 16;
+
+/**
+ * The start index for extracting the core type name from an object.
+ * (e.g., skips "[object " in "[object String]")
+ * @type {number}
+ */
 export const TYPE_FROM = 8;
-export const TYPE_TO = -1;
 
-/* regexp */
-export const REG_B64 = /^[\w+/=-]+$/;
-export const REG_CHARSET = /^charset=([\w#&.;-]+)$/;
-export const REG_DATA_URL = /data:[\w#&+./;=-]*,/;
-export const REG_DATA_URL_B64 = /data:[\w#&+./;=^]*base64,[\w+/=-]+/i;
-export const REG_DATA_URL_G = /data:[\w#&+./;=-]*,[^\x22]+/g;
-export const REG_NUM_REF = /&#(x(?:00)?[\dA-F]{2}|0?\d{1,3});?/gi;
-export const REG_MIME_DOM =
-  /^(?:application\/(?:[\w#&.;-]+\+)?x|image\/svg\+x|text\/(?:ht|x))ml;?/;
-export const REG_MIME_TEXT = /^text\/[\w#&.;-]+/;
-export const REG_SCHEME = /^[a-z][\da-z+.-]*$/;
-export const REG_SCHEME_EXT = /^(?:ext|web)\+[a-z]+$/;
-export const REG_SCRIPT = /(?:java|vb)script/;
-export const REG_SCRIPT_BLOB = /(?:java|vb)script|blob/;
-export const REG_TAG_QUOT = /%(?:22|27|3C|3E)|[\x22\x27<>]/;
-export const REG_URL_ENC = /^%[\dA-F]{2}$/i;
+/**
+ * The end index for extracting the core type name from an object.
+ * (e.g., excludes the trailing "]" in "[object String]")
+ * @type {number}
+ */
+export const TYPE_TO = -1;

package/src/mjs/dompurify.js

@@ -6,4 +6,10 @@ import DOMPurify from 'dompurify';
 import { JSDOM } from 'jsdom';
 
 const { window } = new JSDOM('');
+
+/**
+ * An instance of DOMPurify initialized with a JSDOM window context.
+ * Used to sanitize HTML/SVG strings.
+ * @type {import('dompurify')}
+ */
 export const domPurify = DOMPurify(window);

package/src/mjs/file-reader.js

@@ -4,18 +4,31 @@
 
 /* shared */
 import { getType, isString } from './common.js';
-import { textChars } from './lib-util.js';
 
 /* constants */
-import {
-  CHUNK_SIZE, REG_CHARSET, REG_MIME_DOM, REG_MIME_TEXT
-} from './constant.js';
+import { CHUNK_SIZE } from './constant.js';
+import { REG_CHARSET, REG_MIME_DOM, REG_MIME_TEXT } from './regexp.js';
+import { CTRL_CHAR_CODES } from './text-chars.js';
 const DONE = 2;
 const EMPTY = 0;
 const LOADING = 1;
 
 /**
- * progress event
+ * Converts a Uint8Array to a binary string in chunks to prevent stack overflow.
+ * @private
+ * @param {Uint8Array} uint8arr - The array to convert.
+ * @returns {string} The resulting binary string.
+ */
+const getBinaryString = uint8arr => {
+  const chunks = [];
+  for (let i = 0; i < uint8arr.length; i += CHUNK_SIZE) {
+    chunks.push(String.fromCharCode(...uint8arr.subarray(i, i + CHUNK_SIZE)));
+  }
+  return chunks.join('');
+};
+
+/**
+ * Represents a progress event.
  * @see {@link https://xhr.spec.whatwg.org/#interface-progressevent}
  */
 export class ProgressEvent extends Event {
@@ -25,15 +38,15 @@ export class ProgressEvent extends Event {
   #total;
 
   /**
-   * construct
-   * @param {string} type - type
-   * @param {object} [opt] - init options
-   * @param {boolean} [opt.bubbles] - bubbles
-   * @param {boolean} [opt.cancelable] - cancelable
-   * @param {boolean} [opt.composed] - composed
-   * @param {boolean} [opt.lengthComputable] - lengthComputable
-   * @param {number} [opt.loaded] - loaded
-   * @param {number} [opt.total] - total
+   * Creates a new ProgressEvent instance.
+   * @param {string} type - The event type.
+   * @param {object} [opt] - Initialization options.
+   * @param {boolean} [opt.bubbles] - Whether the event bubbles.
+   * @param {boolean} [opt.cancelable] - Whether the event is cancelable.
+   * @param {boolean} [opt.composed] - Whether the event is composed.
+   * @param {boolean} [opt.lengthComputable] - Whether the length is computable.
+   * @param {number} [opt.loaded] - The amount of work already performed.
+   * @param {number} [opt.total] - The total amount of work to be performed.
    */
   constructor(type, opt = {}) {
     const {
@@ -49,23 +62,37 @@ export class ProgressEvent extends Event {
     this.#total = Number.isInteger(total) && total > 0 ? total : 0;
   }
 
-  /* getter */
+  /**
+   * Indicates whether the total size of the transfer is computable.
+   * @type {boolean}
+   */
   get lengthComputable() {
     return this.#lengthComputable;
   }
 
+  /**
+   * The number of bytes already loaded.
+   * @type {number}
+   */
   get loaded() {
     return this.#loaded;
   }
 
+  /**
+   * The total number of bytes to be loaded.
+   * @type {number}
+   */
   get total() {
     return this.#total;
   }
 }
 
 /**
- * file reader
+ * Asynchronously reads the contents of files (or raw data buffers).
  * @see {@link https://w3c.github.io/FileAPI/#APIASynch}
+ * @property {number} EMPTY - The read operation has not started yet.
+ * @property {number} LOADING - The data is currently being read.
+ * @property {number} DONE - The read operation has completed successfully or failed.
  */
 export class FileReader extends EventTarget {
   /* private fields */
@@ -75,7 +102,7 @@ export class FileReader extends EventTarget {
   #terminate = false;
 
   /**
-   * construct
+   * Creates a new FileReader instance.
    */
   constructor() {
     super();
@@ -84,38 +111,48 @@ export class FileReader extends EventTarget {
     this.DONE = DONE;
   }
 
-  /* getter */
+  /**
+   * The error that occurred while reading the file.
+   * @type {Error|DOMException|null}
+   */
   get error() {
     return this.#error;
   }
 
+  /**
+   * The current state of the FileReader operation.
+   * @type {number}
+   */
   get readyState() {
     return this.#state;
   }
 
+  /**
+   * The file's contents. Only valid after the read operation is complete.
+   * @type {string|ArrayBuffer|null}
+   */
   get result() {
     return this.#result;
   }
 
   /**
-   * dispatch progress event
-   * @param {string} type - event type
-   * @returns {boolean} - result
+   * Dispatches a progress event.
+   * @private
+   * @param {string} type - The type of the event to dispatch.
+   * @returns {boolean} True if dispatched and not canceled, false otherwise.
    */
   _dispatchProgressEvent(type) {
-    if (isString(type)) {
-      type = type.trim();
-      if (!/abort|error|load(?:end|start)?|progress/.test(type)) {
-        this.#error = new DOMException('Invalid state.', 'InvalidStateError');
-        this._dispatchProgressEvent('error');
-        throw this.#error;
-      }
-    } else {
+    if (!isString(type)) {
       this.#error = new TypeError(`Expected String but got ${getType(type)}.`);
       this._dispatchProgressEvent('error');
       throw this.#error;
     }
-    if (type === 'error' && !this.#error) {
+    type = type.trim();
+    if (!/abort|error|load(?:end|start)?|progress/.test(type)) {
+      this.#error = new DOMException('Invalid state.', 'InvalidStateError');
+      this._dispatchProgressEvent('error');
+      throw this.#error;
+    } else if (type === 'error' && !this.#error) {
       this.#error = new Error('Unknown error.');
     }
     const evt = new ProgressEvent(type, {
@@ -128,27 +165,40 @@ export class FileReader extends EventTarget {
   }
 
   /**
-   * abort
+   * Aborts the ongoing read operation.
    * @returns {void}
    */
   abort() {
+    if (this.#state === this.EMPTY || this.#state === this.DONE) {
+      this.#result = null;
+      return;
+    }
     this.#state = this.DONE;
     this.#result = null;
     this.#terminate = true;
+    this.#error =
+      new DOMException('The read operation was aborted.', 'AbortError');
     this._dispatchProgressEvent('abort');
     this._dispatchProgressEvent('loadend');
   }
 
   /**
-   * read blob
-   * @param {object} blob - blob
-   * @param {string} format - format to read as
-   * @param {string} [encoding] - character encoding
-   * @returns {Promise.<void>} - void
+   * Reads the given blob based on the specified format.
+   * @private
+   * @param {Blob} blob - The target Blob object.
+   * @param {string} format - The format in which to read the blob data.
+   * @param {string} [encoding] - The character encoding for text formats.
+   * @returns {Promise<void>}
    */
   async _read(blob, format, encoding = '') {
-    if (!(blob instanceof Blob && isString(format) && isString(encoding))) {
-      this.abort();
+    if (!(blob instanceof Blob)) {
+      throw new TypeError(`Expected Blob but got ${getType(blob)}.`);
+    }
+    if (!isString(format)) {
+      throw new TypeError(`Expected String but got ${getType(format)}.`);
+    }
+    if (!isString(encoding)) {
+      throw new TypeError(`Expected String but got ${getType(encoding)}.`);
     }
     if (!this.#terminate) {
       if (this.#state === this.LOADING) {
@@ -165,32 +215,39 @@ export class FileReader extends EventTarget {
         const mediaTypes = type ? type.split(';') : [];
         const buffer = await blob.arrayBuffer();
         const uint8arr = new Uint8Array(buffer);
-        const chunkSize = CHUNK_SIZE;
-        let binary = '';
-        for (let i = 0; i < uint8arr.length; i += chunkSize) {
-          binary += String.fromCharCode(...uint8arr.subarray(i, i + chunkSize));
-        }
         this._dispatchProgressEvent('loadstart');
         switch (format) {
-          case 'arrayBuffer':
+          case 'arrayBuffer': {
             res = buffer;
             this._dispatchProgressEvent('progress');
             break;
-          case 'binaryString':
-            res = binary;
+          }
+          case 'binaryString': {
+            res = getBinaryString(uint8arr);
             this._dispatchProgressEvent('progress');
             break;
-          case 'dataURL':
-            if (!mediaTypes.length ||
-                mediaTypes[mediaTypes.length - 1] !== 'base64') {
-              mediaTypes.push('base64');
+          }
+          case 'dataURL': {
+            const mime = mediaTypes.length > 0 ? mediaTypes.join(';') : '';
+            const mimeStr = mime ? `${mime};base64` : 'base64';
+            if (typeof globalThis.Buffer !== 'undefined') {
+              const base64 = globalThis.Buffer.from(buffer).toString('base64');
+              res = `data:${mimeStr},${base64}`;
+            } else {
+              res = `data:${mimeStr},${btoa(getBinaryString(uint8arr))}`;
             }
-            res = `data:${mediaTypes.join(';')},${btoa(binary)}`;
             this._dispatchProgressEvent('progress');
             break;
+          }
           case 'text': {
-            const textCharCodes = new Set(textChars);
-            if (uint8arr.every(c => textCharCodes.has(c))) {
+            let isSafeText = true;
+            for (const i of uint8arr) {
+              if (CTRL_CHAR_CODES.has(i)) {
+                isSafeText = false;
+                break;
+              }
+            }
+            if (isSafeText) {
               let charset;
               for (const media of mediaTypes) {
                 if (REG_CHARSET.test(media)) {
@@ -216,14 +273,14 @@ export class FileReader extends EventTarget {
               }
               if (REG_MIME_DOM.test(type)) {
                 if (encoding === charset || (encoding === 'utf8' && !charset)) {
-                  res = binary;
+                  res = getBinaryString(uint8arr);
                   this._dispatchProgressEvent('progress');
                 }
               } else if (REG_MIME_TEXT.test(type)) {
                 if (encoding === charset ||
                     (encoding === 'utf8' &&
                      (!charset || charset === 'us-ascii'))) {
-                  res = binary;
+                  res = getBinaryString(uint8arr);
                   this._dispatchProgressEvent('progress');
                 }
               }
@@ -254,37 +311,37 @@ export class FileReader extends EventTarget {
   }
 
   /**
-   * read as arrayBuffer
-   * @param {object} blob - blob
-   * @returns {Promise.<void>} - void
+   * Reads the contents of the specified Blob as an ArrayBuffer.
+   * @param {Blob} blob - The target Blob object.
+   * @returns {Promise<void>}
    */
   async readAsArrayBuffer(blob) {
     await this._read(blob, 'arrayBuffer');
   }
 
   /**
-   * read as binary string
-   * @param {object} blob - blob
-   * @returns {Promise.<void>} - void
+   * Reads the contents of the specified Blob as a binary string.
+   * @param {Blob} blob - The target Blob object.
+   * @returns {Promise<void>}
    */
   async readAsBinaryString(blob) {
     await this._read(blob, 'binaryString');
   }
 
   /**
-   * read as data URL
-   * @param {object} blob - blob
-   * @returns {Promise.<void>} - void
+   * Reads the contents of the specified Blob as a base64-encoded data URL.
+   * @param {Blob} blob - The target Blob object.
+   * @returns {Promise<void>}
    */
   async readAsDataURL(blob) {
     await this._read(blob, 'dataURL');
   }
 
   /**
-   * read as text
-   * @param {object} blob - blob
-   * @param {string} [encoding] - encoding
-   * @returns {Promise.<void>} - void
+   * Reads the contents of the specified Blob as text.
+   * @param {Blob} blob - The target Blob object.
+   * @param {string} [encoding] - The character encoding to use.
+   * @returns {Promise<void>}
    */
   async readAsText(blob, encoding) {
     await this._read(blob, 'text', encoding);

package/src/mjs/regexp.js

@@ -0,0 +1,79 @@
+/**
+ * regexp.js
+ */
+
+/**
+ * Matches and captures the charset parameter in a media type string.
+ * @type {RegExp}
+ */
+export const REG_CHARSET = /^charset=([\w#&.;-]+)$/;
+
+/**
+ * Matches a trailing empty fragment identifier (#).
+ * @type {RegExp}
+ */
+export const REG_HASH = /(?:#|%23)$/;
+
+/**
+ * Matches MIME types that contain DOM-parsable content (HTML, XML, SVG).
+ * @type {RegExp}
+ */
+export const REG_MIME_DOM =
+  /^(?:application\/(?:[\w#&.;-]+\+)?x|image\/svg\+x|text\/(?:ht|x))ml;?/;
+
+/**
+ * Matches general text MIME types.
+ * @type {RegExp}
+ */
+export const REG_MIME_TEXT = /^text\/[\w#&.;-]+/;
+
+/**
+ * Matches a trailing empty query string (?), ensuring it is not part of a hash.
+ * @type {RegExp}
+ */
+export const REG_QUERY = /(?<!(?:#|%23).*)(?:\?|%3F)$/;
+
+/**
+ * Validates a string against standard IANA URI scheme syntax.
+ * @type {RegExp}
+ */
+export const REG_SCHEME = /^[a-z][\da-z+.-]*$/;
+
+/**
+ * Matches web custom schemes (`web+`) or application-specific schemes (`ext+`).
+ * - `web+` schemes comply with the HTML Standard.
+ * - `ext+` schemes comply with RFC 3986 but disallow `+` in the suffix.
+ * @type {RegExp}
+ */
+export const REG_SCHEME_EXT = /^(?:web\+[a-z]+|ext\+[a-z][\da-z.-]*)$/;
+
+/**
+ * Matches executable script schemes (javascript or vbscript), case-insensitive.
+ * @type {RegExp}
+ */
+export const REG_SCRIPT = /^(?:java|vb)script$/i;
+
+/**
+ * Matches script-executing or data-fetching schemes.
+ * @type {RegExp}
+ */
+export const REG_SCRIPT_BLOB = /^(?:(?:java|vb)script|blob)$/i;
+
+/**
+ * Matches HTML tags, quotes, and their encoded or character reference variants.
+ * @type {RegExp}
+ */
+export const REG_TAG_QUOT =
+  /["'<>]|%(?:22|27|3C|3E)|&(?:apos|lt|gt|quot|#0*(?:34|39|60|62)|#x0*(?:22|27|3C|3E));/i;
+
+/**
+ * Matches a valid percent-encoded character format (%XX).
+ * @type {RegExp}
+ */
+export const REG_URL_ENC = /^%[\dA-F]{2}$/i;
+
+/**
+ * Validates relative URLs and flags invalid patterns.
+ * @type {RegExp}
+ */
+export const REG_VERIFY_RELATIVE = /^(?:\/{2,}|\\|[a-z][a-z\d+\-.]*:[^/])/i;