url-sanitizer 4.1.3 → 4.2.0

package/package.json

@@ -32,14 +32,14 @@
     "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^28.0.3",
     "@types/node": "^26.1.1",
-    "c8": "^11.0.0",
+    "c8": "^12.0.0",
     "chai": "^6.2.2",
     "commander": "^15.0.0",
     "copyfiles-ng": "^2.4.7",
     "esbuild": "^0.28.1",
     "eslint": "^9.39.5",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^63.0.13",
+    "eslint-plugin-jsdoc": "^63.2.2",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-regexp": "^3.1.1",
     "eslint-plugin-unicorn": "^64.0.0",
@@ -50,23 +50,22 @@
     "mocha": "^11.7.6",
     "neostandard": "^0.13.0",
     "papaparse": "^5.5.4",
-    "prettier": "^3.9.5",
-    "sinon": "^22.0.0",
+    "prettier": "^3.9.6",
+    "sinon": "^22.1.0",
     "strict-url-sanitise": "^0.0.1",
-    "typescript": "^6.0.3",
-    "undici": "^7.28.0"
+    "typescript": "^7.0.2",
+    "undici": "^7.29.0"
   },
   "overrides": {
     "c8": {
       "yargs": "^18.0.0"
     },
     "eslint": {
-      "brace-expansion": "^1.1.13",
-      "js-yaml": "^4.2.0"
+      "js-yaml": "^4.3.0"
     },
     "mocha": {
       "diff": "^8.0.3",
-      "js-yaml": "^4.2.0"
+      "js-yaml": "^4.3.0"
     },
     "serialize-javascript": "^7.0.4"
   },
@@ -94,5 +93,5 @@
   "engines": {
     "node": ">=22.13"
   },
-  "version": "4.1.3"
+  "version": "4.2.0"
 }

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]
+["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/dompurify.js

@@ -10,6 +10,6 @@ const { window } = new JSDOM('');
 /**
  * An instance of DOMPurify initialized with a JSDOM window context.
  * Used to sanitize HTML/SVG strings.
- * @type {import('dompurify')}
+ * @type {import('dompurify').DOMPurify}
  */
 export const domPurify = DOMPurify(window);

package/src/mjs/regexp.js

@@ -80,9 +80,16 @@ export const REG_URL_ENC = /^%[\dA-F]{2}$/i;
 
 /**
  * Matches an ampersand-encoded character (&foo).
+ * @type {RegExp}
  */
 export const REG_AMP_ENC = /&(?=[#a-z0-9])(?![a-z0-9]+=)/i;
 
+/**
+ * Match one or more consecutive URL percent-encoded sequences (%20, %E3%81%82).
+ * @type {RegExp}
+ */
+export const REG_PCT_ENC = /(?:%[\dA-F]{2})+/gi;
+
 /**
  * Validates relative URLs and flags invalid patterns.
  * @type {RegExp}

package/src/mjs/sanitizer.js

@@ -126,10 +126,8 @@ class URLSanitizer extends URISchemes {
     if (!sanitizer || !ctx) {
       return;
     }
-    let urlObj;
-    try {
-      urlObj = new URL(evt.attrValue);
-    } catch {
+    const urlObj = URL.parse(evt.attrValue);
+    if (!urlObj) {
       return;
     }
     if (urlObj.protocol === 'data:') {
@@ -357,10 +355,10 @@ class URLSanitizer extends URISchemes {
     let relativeParsedPath = '';
     // Handle Relative URLs
     if (!isVerified && allowRelative && !REG_VERIFY_RELATIVE.test(url)) {
-      try {
-        const dummyUrl = new URL(url, 'http://dummy.local');
-        const normUrl = url.normalize('NFKC');
-        const dummyUrlNormalized = new URL(normUrl, 'http://dummy.local');
+      const normUrl = url.normalize('NFKC');
+      const dummyUrl = URL.parse(url, 'http://dummy.local');
+      const dummyUrlNormalized = URL.parse(normUrl, 'http://dummy.local');
+      if (dummyUrl && dummyUrlNormalized) {
         if (
           dummyUrl.protocol === 'http:' &&
           dummyUrl.hostname === 'dummy.local' &&
@@ -370,8 +368,8 @@ class URLSanitizer extends URISchemes {
           isRelative = true;
           relativeParsedPath = `${dummyUrl.pathname}${dummyUrl.search}${dummyUrl.hash}`;
         }
-      } catch (e) {
-        logDebug(ctx.debug, 'Failed to parse relative URL.', e);
+      } else {
+        logDebug(ctx.debug, 'Failed to parse relative URL.');
       }
     }
     if (!isVerified) {
@@ -388,7 +386,7 @@ class URLSanitizer extends URISchemes {
         urlToSanitize: relativeParsedPath
       };
     }
-    const urlObj = new URL(url);
+    const urlObj = URL.parse(url);
     const scheme = urlObj.protocol.replace(/:$/, '').normalize('NFKC');
     const schemeParts = scheme.split('+');
     return {
@@ -455,14 +453,18 @@ class URLSanitizer extends URISchemes {
       const decodedData = parseURLEncodedNumCharRef(parsedData).trim();
       const normalizedData = decodedData.normalize('NFKC');
       const dummy = 'http://dummy.local';
-      const { protocol: dataScheme } = new URL(normalizedData, dummy);
+      const parsedUrl = URL.parse(normalizedData, dummy);
+      if (!parsedUrl) {
+        logDebug(ctx.debug, 'Failed to parse inner data URL protocol.');
+        return null;
+      }
+      const dataScheme = parsedUrl.protocol;
       const dataSchemeParts = dataScheme.replace(/:$/, '').split('+');
       if (dataSchemeParts.some(s => REG_SCRIPT_BLOB.test(s))) {
         return null;
       }
     } catch (e) {
-      const msg = 'Failed to parse inner data URL protocol.';
-      logDebug(ctx.debug, msg, e);
+      logDebug(ctx.debug, 'Failed to parse inner data URL protocol.', e);
       return null;
     }
     if (!mediaType || REG_MIME_DOM.test(mediaType)) {
@@ -531,12 +533,11 @@ class URLSanitizer extends URISchemes {
       !REG_TAG_QUOT.test(url) &&
       !url.includes('data:')
     ) {
-      try {
-        const { href } = new URL(url);
-        return href.replace(/%26/g, escapeURLEncodedHTMLChars);
-      } catch (e) {
-        const msg = `Failed to parse URL.`;
-        logDebug(opt?.debug, msg, e);
+      const parsedUrl = URL.parse(url);
+      if (parsedUrl) {
+        return parsedUrl.href.replace(/%26/g, escapeURLEncodedHTMLChars);
+      } else {
+        logDebug(opt?.debug, `Failed to parse URL.`);
         return null;
       }
     }
@@ -662,7 +663,9 @@ class URLSanitizer extends URISchemes {
    * @returns {string[]} The updated array of registered schemes.
    */
   add(scheme) {
-    if (!isString(scheme)) {
+    if (isString(scheme)) {
+      scheme = scheme.trim();
+    } else {
       throw new TypeError(`Expected String but got ${getType(scheme)}.`);
     }
     const schemeParts = scheme.split('+');
@@ -742,11 +745,11 @@ export const sanitizeURL = async (
   let res;
   if (url && isString(url)) {
     let scheme;
-    try {
-      const { protocol } = new URL(url);
-      scheme = protocol.replace(/:$/, '');
-    } catch (e) {
-      logDebug(isDebug, `Invalid URL input format: ${url}`, e);
+    const parsedUrl = URL.parse(url);
+    if (parsedUrl) {
+      scheme = parsedUrl.protocol.replace(/:$/, '');
+    } else {
+      logDebug(isDebug, `Invalid URL input format: ${url}`);
     }
     if (scheme === 'blob') {
       const { allow, deny, only } = opt;
@@ -822,12 +825,11 @@ export const sanitizeURLSync = (
   let res;
   if (url && isString(url)) {
     let scheme;
-    try {
-      const { protocol } = new URL(url);
-      scheme = protocol.replace(/:$/, '');
-    } catch (e) {
-      const msg = `Invalid URL input format: ${url}`;
-      logDebug(isDebug, msg, e);
+    const parsedUrl = URL.parse(url);
+    if (parsedUrl) {
+      scheme = parsedUrl.protocol.replace(/:$/, '');
+    } else {
+      logDebug(isDebug, `Invalid URL input format: ${url}`);
     }
     if (scheme === 'blob') {
       if (opt?.revokeObjectURL) {
@@ -852,11 +854,11 @@ export const inspectURL = async url => {
 };
 
 /**
- * @deprecated Use inspectURL instead.
+ * @deprecated Use {@link inspectURL} instead.
  * @param {string} url - The URL string to inspect.
  * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
  */
-export const parseURL = url => inspectURL(url);
+export const parseURL = async url => inspectURL(url);
 
 /**
  * Inspects, parses, and sanitizes the given URL synchronously.
@@ -866,7 +868,7 @@ export const parseURL = url => inspectURL(url);
 export const inspectURLSync = url => urlSanitizer.inspect(url);
 
 /**
- * @deprecated Use inspectURLSync instead.
+ * @deprecated Use {@link inspectURLSync} instead.
  * @param {string} url - The URL string to inspect.
  * @returns {InspectedURLResult} The inspected URL result.
  */

package/src/mjs/uri-util.js

@@ -11,6 +11,7 @@ import { CHUNK_SIZE, DECI, HEX, MAX_BLOB_SIZE, MAX_NEST } from './constant.js';
 import {
   REG_HASH,
   REG_NUM_REF,
+  REG_PCT_ENC,
   REG_QUERY,
   REG_SCHEME_EXT,
   REG_SCRIPT,
@@ -88,18 +89,18 @@ export class URISchemes {
     if (!isString(uri)) {
       return false;
     }
-    try {
-      const { protocol } = new URL(uri.normalize('NFKC'));
-      const scheme = protocol.replace(/:$/, '');
-      const parts = scheme.split('+');
-      const isScript = parts.some(s => REG_SCRIPT.test(s));
-      if (isScript) {
-        return false;
-      }
-      return REG_SCHEME_EXT.test(scheme) || parts.every(s => schemes.has(s));
-    } catch {
+    const normalizedUri = uri.normalize('NFKC');
+    const parsedUrl = URL.parse(normalizedUri);
+    if (!parsedUrl) {
+      return false;
+    }
+    const scheme = parsedUrl.protocol.replace(/:$/, '');
+    const parts = scheme.split('+');
+    const isScript = parts.some(s => REG_SCRIPT.test(s));
+    if (isScript) {
       return false;
     }
+    return REG_SCHEME_EXT.test(scheme) || parts.every(s => schemes.has(s));
   }
 }
 
@@ -113,11 +114,11 @@ export const getURLEncodedString = str => {
     throw new TypeError(`Expected String but got ${getType(str)}.`);
   }
   const bytes = encoder.encode(str);
-  const encoded = [];
+  let encoded = '';
   for (let i = 0; i < bytes.length; i++) {
-    encoded.push(HEX_TABLE[bytes[i]]);
+    encoded += HEX_TABLE[bytes[i]];
   }
-  return encoded.join('');
+  return encoded;
 };
 
 /**
@@ -226,7 +227,7 @@ export const parseURLEncodedNumCharRef = (str, nest = 0) => {
     res = decodeURIComponent(str);
   } catch {
     // Fallback: decode only valid multi-byte %XX sequences.
-    res = str.replace(/(?:%[\dA-F]{2})+/gi, match => {
+    res = str.replace(REG_PCT_ENC, match => {
       try {
         return decodeURIComponent(match);
       } catch {

package/types/index.d.ts

@@ -1 +1,8 @@
-export { default, inspectURL, inspectURLSync, isURI, isURISync, parseURL, parseURLSync, sanitizeURL, sanitizeURLSync } from "./mjs/sanitizer.js";
+/*!
+ * URL Sanitizer
+ *
+ * @license MIT
+ * @copyright asamuzaK (Kazz)
+ * @see {@link https://github.com/asamuzaK/urlSanitizer/blob/main/LICENSE}
+ */
+export { default, inspectURL, inspectURLSync, isURI, isURISync, parseURL, parseURLSync, sanitizeURL, sanitizeURLSync } from './mjs/sanitizer.js';

package/types/mjs/common.d.ts

@@ -1,2 +1,2 @@
-export function getType(o: unknown): string;
-export function isString(o: unknown): boolean;
+export declare const getType: (o: unknown) => string;
+export declare const isString: (o: unknown) => boolean;

package/types/mjs/constant.d.ts

@@ -1,7 +1,7 @@
-export const CHUNK_SIZE: number;
-export const DECI: number;
-export const HEX: number;
-export const MAX_BLOB_SIZE: number;
-export const MAX_NEST: number;
-export const TYPE_FROM: number;
-export const TYPE_TO: number;
+export declare const CHUNK_SIZE: number;
+export declare const DECI: number;
+export declare const HEX: number;
+export declare const MAX_BLOB_SIZE: number;
+export declare const MAX_NEST: number;
+export declare const TYPE_FROM: number;
+export declare const TYPE_TO: number;

package/types/mjs/dompurify.d.ts

@@ -1 +1 @@
-export const domPurify: typeof import("dompurify");
+export declare const domPurify: import('dompurify').DOMPurify;

package/types/mjs/regexp.d.ts

@@ -1,14 +1,15 @@
-export const REG_CHARSET: RegExp;
-export const REG_HASH: RegExp;
-export const REG_MIME_DOM: RegExp;
-export const REG_MIME_TEXT: RegExp;
-export const REG_NUM_REF: RegExp;
-export const REG_QUERY: RegExp;
-export const REG_SCHEME: RegExp;
-export const REG_SCHEME_EXT: RegExp;
-export const REG_SCRIPT: RegExp;
-export const REG_SCRIPT_BLOB: RegExp;
-export const REG_TAG_QUOT: RegExp;
-export const REG_URL_ENC: RegExp;
-export const REG_AMP_ENC: RegExp;
-export const REG_VERIFY_RELATIVE: RegExp;
+export declare const REG_CHARSET: RegExp;
+export declare const REG_HASH: RegExp;
+export declare const REG_MIME_DOM: RegExp;
+export declare const REG_MIME_TEXT: RegExp;
+export declare const REG_NUM_REF: RegExp;
+export declare const REG_QUERY: RegExp;
+export declare const REG_SCHEME: RegExp;
+export declare const REG_SCHEME_EXT: RegExp;
+export declare const REG_SCRIPT: RegExp;
+export declare const REG_SCRIPT_BLOB: RegExp;
+export declare const REG_TAG_QUOT: RegExp;
+export declare const REG_URL_ENC: RegExp;
+export declare const REG_AMP_ENC: RegExp;
+export declare const REG_PCT_ENC: RegExp;
+export declare const REG_VERIFY_RELATIVE: RegExp;

package/types/mjs/sanitizer.d.ts

@@ -1,30 +1,4 @@
-export function logDebug(isDebug: boolean, message: string, error?: Error): void;
-export function sanitizeURL(url: string, opt?: {
-    allow?: string[] | undefined;
-    deny?: string[] | undefined;
-    only?: string[] | undefined;
-    allowRelative?: boolean | undefined;
-    debug?: boolean | undefined;
-    revokeObjectURL?: boolean | undefined;
-    maxBlobSize?: number | undefined;
-    maxLength?: number | undefined;
-}): Promise<string | null>;
-export function sanitizeURLSync(url: string, opt?: {
-    allow?: string[] | undefined;
-    deny?: string[] | undefined;
-    only?: string[] | undefined;
-    allowRelative?: boolean | undefined;
-    debug?: boolean | undefined;
-    revokeObjectURL?: boolean | undefined;
-    maxLength?: number | undefined;
-}): string | null;
-export function inspectURL(url: string): Promise<InspectedURLResult>;
-export function parseURL(url: string): Promise<InspectedURLResult>;
-export function inspectURLSync(url: string): InspectedURLResult;
-export function parseURLSync(url: string): InspectedURLResult;
-export function isURI(uri: string): Promise<boolean>;
-export function isURISync(uri: string): boolean;
-export default urlSanitizer;
+import { URISchemes } from './uri-util.js';
 export type InspectedDataURL = {
     mime: string;
     base64: boolean;
@@ -33,38 +7,75 @@ export type InspectedDataURL = {
 export type InspectedURLResult = {
     input: string;
     valid: boolean;
-    reason?: string | undefined;
-    data?: InspectedDataURL | null | undefined;
-    href?: string | undefined;
-    origin?: string | undefined;
-    protocol?: string | undefined;
-    username?: string | undefined;
-    password?: string | undefined;
-    host?: string | undefined;
-    hostname?: string | undefined;
-    port?: string | undefined;
-    pathname?: string | undefined;
-    search?: string | undefined;
-    hash?: string | undefined;
+    reason?: string;
+    data?: InspectedDataURL | null;
+    href?: string;
+    origin?: string;
+    protocol?: string;
+    username?: string;
+    password?: string;
+    host?: string;
+    hostname?: string;
+    port?: string;
+    pathname?: string;
+    search?: string;
+    hash?: string;
 };
-export class URLSanitizer extends URISchemes {
-    static #currentInstance: URLSanitizer | null;
-    static #currentCtx: null;
+export declare const logDebug: (isDebug: boolean, message: string, error?: Error) => void;
+declare class URLSanitizer extends URISchemes {
+    #private;
     private static #uponSanitizeAttribute;
+    constructor();
+    private #registerScheme;
+    private #purify;
+    private #process;
+    private #resolveSchemeRules;
+    private #parseAndVerifyURL;
+    private #isSchemeAllowed;
+    private #sanitizeDataURL;
+    private #sanitizeStandardURL;
     sanitize(url: string, opt?: {
-        allow?: string[] | undefined;
-        deny?: string[] | undefined;
-        only?: string[] | undefined;
-        allowRelative?: boolean | undefined;
-        debug?: boolean | undefined;
-        maxBlobSize?: number | undefined;
-        maxLength?: number | undefined;
+        allow?: string[];
+        deny?: string[];
+        only?: string[];
+        allowRelative?: boolean;
+        debug?: boolean;
+        maxBlobSize?: number;
+        maxLength?: number;
     }): string | null;
     inspect(url: string, opt?: object): InspectedURLResult;
+    get(): string[];
+    has(scheme: string): boolean;
     add(scheme: string): string[];
     remove(scheme: string): boolean;
     reset(): void;
-    #private;
+    verify(uri: string, schemes?: Set<string>): boolean;
 }
+export { URLSanitizer };
 declare const urlSanitizer: URLSanitizer;
-import { URISchemes } from './uri-util.js';
+export declare const sanitizeURL: (url: string, opt?: {
+    allow?: string[];
+    deny?: string[];
+    only?: string[];
+    allowRelative?: boolean;
+    debug?: boolean;
+    revokeObjectURL?: boolean;
+    maxBlobSize?: number;
+    maxLength?: number;
+}) => Promise<string | null>;
+export declare const sanitizeURLSync: (url: string, opt?: {
+    allow?: string[];
+    deny?: string[];
+    only?: string[];
+    allowRelative?: boolean;
+    debug?: boolean;
+    revokeObjectURL?: boolean;
+    maxLength?: number;
+}) => string | null;
+export declare const inspectURL: (url: string) => Promise<InspectedURLResult>;
+export declare const parseURL: (url: string) => Promise<InspectedURLResult>;
+export declare const inspectURLSync: (url: string) => InspectedURLResult;
+export declare const parseURLSync: (url: string) => InspectedURLResult;
+export declare const isURI: (uri: string) => Promise<boolean>;
+export declare const isURISync: (uri: string) => boolean;
+export default urlSanitizer;

package/types/mjs/text-chars.d.ts

@@ -1,3 +1,3 @@
-export const TEXT_CHAR_CODES: Set<number>;
-export const WINDOWS1252_TO_UNICODE: Map<number, number>;
-export const CTRL_CHAR_CODES: Map<number, string>;
+export declare const TEXT_CHAR_CODES: Set<number>;
+export declare const WINDOWS1252_TO_UNICODE: Map<number, number>;
+export declare const CTRL_CHAR_CODES: Map<number, string>;

package/types/mjs/uri-util.d.ts

@@ -1,13 +1,13 @@
-export class URISchemes {
+export declare class URISchemes {
+    #private;
     get(): string[];
     has(scheme: string): boolean;
     verify(uri: string, schemes?: Set<string>): boolean;
-    #private;
 }
-export function getURLEncodedString(str: string): string;
-export function escapeURLEncodedHTMLChars(ch: string): string;
-export function parseBase64(data: string): string;
-export function replaceNumCharRef(match: string, value: string): string;
-export function trimTrailingEmptyQueryAndHash(url: string): string;
-export function parseURLEncodedNumCharRef(str: string, nest?: number): string;
-export function convertBlobToDataURL(blob: Blob, maxSize?: number): Promise<string | null>;
+export declare const getURLEncodedString: (str: string) => string;
+export declare const escapeURLEncodedHTMLChars: (ch: string) => string;
+export declare const parseBase64: (data: string) => string;
+export declare const replaceNumCharRef: (match: string, value: string) => string;
+export declare const trimTrailingEmptyQueryAndHash: (url: string) => string;
+export declare const parseURLEncodedNumCharRef: (str: string, nest?: number) => string;
+export declare const convertBlobToDataURL: (blob: Blob, maxSize?: number) => Promise<string | null>;