url-sanitizer 4.1.4 → 4.2.0

package/package.json

@@ -39,7 +39,7 @@
     "esbuild": "^0.28.1",
     "eslint": "^9.39.5",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^63.0.14",
+    "eslint-plugin-jsdoc": "^63.2.2",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-regexp": "^3.1.1",
     "eslint-plugin-unicorn": "^64.0.0",
@@ -50,23 +50,22 @@
     "mocha": "^11.7.6",
     "neostandard": "^0.13.0",
     "papaparse": "^5.5.4",
-    "prettier": "^3.9.5",
-    "sinon": "^22.0.0",
+    "prettier": "^3.9.6",
+    "sinon": "^22.1.0",
     "strict-url-sanitise": "^0.0.1",
     "typescript": "^7.0.2",
-    "undici": "^7.28.0"
+    "undici": "^7.29.0"
   },
   "overrides": {
     "c8": {
       "yargs": "^18.0.0"
     },
     "eslint": {
-      "brace-expansion": "^1.1.13",
-      "js-yaml": "^4.2.0"
+      "js-yaml": "^4.3.0"
     },
     "mocha": {
       "diff": "^8.0.3",
-      "js-yaml": "^4.2.0"
+      "js-yaml": "^4.3.0"
     },
     "serialize-javascript": "^7.0.4"
   },
@@ -94,5 +93,5 @@
   "engines": {
     "node": ">=22.13"
   },
-  "version": "4.1.4"
+  "version": "4.2.0"
 }

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]
+["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/dompurify.js

@@ -10,6 +10,6 @@ const { window } = new JSDOM('');
 /**
  * An instance of DOMPurify initialized with a JSDOM window context.
  * Used to sanitize HTML/SVG strings.
- * @type {import('dompurify')}
+ * @type {import('dompurify').DOMPurify}
  */
 export const domPurify = DOMPurify(window);

package/src/mjs/regexp.js

@@ -80,9 +80,16 @@ export const REG_URL_ENC = /^%[\dA-F]{2}$/i;
 
 /**
  * Matches an ampersand-encoded character (&foo).
+ * @type {RegExp}
  */
 export const REG_AMP_ENC = /&(?=[#a-z0-9])(?![a-z0-9]+=)/i;
 
+/**
+ * Match one or more consecutive URL percent-encoded sequences (%20, %E3%81%82).
+ * @type {RegExp}
+ */
+export const REG_PCT_ENC = /(?:%[\dA-F]{2})+/gi;
+
 /**
  * Validates relative URLs and flags invalid patterns.
  * @type {RegExp}

package/src/mjs/sanitizer.js

@@ -126,10 +126,8 @@ class URLSanitizer extends URISchemes {
     if (!sanitizer || !ctx) {
       return;
     }
-    let urlObj;
-    try {
-      urlObj = new URL(evt.attrValue);
-    } catch {
+    const urlObj = URL.parse(evt.attrValue);
+    if (!urlObj) {
       return;
     }
     if (urlObj.protocol === 'data:') {
@@ -357,10 +355,10 @@ class URLSanitizer extends URISchemes {
     let relativeParsedPath = '';
     // Handle Relative URLs
     if (!isVerified && allowRelative && !REG_VERIFY_RELATIVE.test(url)) {
-      try {
-        const dummyUrl = new URL(url, 'http://dummy.local');
-        const normUrl = url.normalize('NFKC');
-        const dummyUrlNormalized = new URL(normUrl, 'http://dummy.local');
+      const normUrl = url.normalize('NFKC');
+      const dummyUrl = URL.parse(url, 'http://dummy.local');
+      const dummyUrlNormalized = URL.parse(normUrl, 'http://dummy.local');
+      if (dummyUrl && dummyUrlNormalized) {
         if (
           dummyUrl.protocol === 'http:' &&
           dummyUrl.hostname === 'dummy.local' &&
@@ -370,8 +368,8 @@ class URLSanitizer extends URISchemes {
           isRelative = true;
           relativeParsedPath = `${dummyUrl.pathname}${dummyUrl.search}${dummyUrl.hash}`;
         }
-      } catch (e) {
-        logDebug(ctx.debug, 'Failed to parse relative URL.', e);
+      } else {
+        logDebug(ctx.debug, 'Failed to parse relative URL.');
       }
     }
     if (!isVerified) {
@@ -388,7 +386,7 @@ class URLSanitizer extends URISchemes {
         urlToSanitize: relativeParsedPath
       };
     }
-    const urlObj = new URL(url);
+    const urlObj = URL.parse(url);
     const scheme = urlObj.protocol.replace(/:$/, '').normalize('NFKC');
     const schemeParts = scheme.split('+');
     return {
@@ -455,14 +453,18 @@ class URLSanitizer extends URISchemes {
       const decodedData = parseURLEncodedNumCharRef(parsedData).trim();
       const normalizedData = decodedData.normalize('NFKC');
       const dummy = 'http://dummy.local';
-      const { protocol: dataScheme } = new URL(normalizedData, dummy);
+      const parsedUrl = URL.parse(normalizedData, dummy);
+      if (!parsedUrl) {
+        logDebug(ctx.debug, 'Failed to parse inner data URL protocol.');
+        return null;
+      }
+      const dataScheme = parsedUrl.protocol;
       const dataSchemeParts = dataScheme.replace(/:$/, '').split('+');
       if (dataSchemeParts.some(s => REG_SCRIPT_BLOB.test(s))) {
         return null;
       }
     } catch (e) {
-      const msg = 'Failed to parse inner data URL protocol.';
-      logDebug(ctx.debug, msg, e);
+      logDebug(ctx.debug, 'Failed to parse inner data URL protocol.', e);
       return null;
     }
     if (!mediaType || REG_MIME_DOM.test(mediaType)) {
@@ -531,12 +533,11 @@ class URLSanitizer extends URISchemes {
       !REG_TAG_QUOT.test(url) &&
       !url.includes('data:')
     ) {
-      try {
-        const { href } = new URL(url);
-        return href.replace(/%26/g, escapeURLEncodedHTMLChars);
-      } catch (e) {
-        const msg = `Failed to parse URL.`;
-        logDebug(opt?.debug, msg, e);
+      const parsedUrl = URL.parse(url);
+      if (parsedUrl) {
+        return parsedUrl.href.replace(/%26/g, escapeURLEncodedHTMLChars);
+      } else {
+        logDebug(opt?.debug, `Failed to parse URL.`);
         return null;
       }
     }
@@ -744,11 +745,11 @@ export const sanitizeURL = async (
   let res;
   if (url && isString(url)) {
     let scheme;
-    try {
-      const { protocol } = new URL(url);
-      scheme = protocol.replace(/:$/, '');
-    } catch (e) {
-      logDebug(isDebug, `Invalid URL input format: ${url}`, e);
+    const parsedUrl = URL.parse(url);
+    if (parsedUrl) {
+      scheme = parsedUrl.protocol.replace(/:$/, '');
+    } else {
+      logDebug(isDebug, `Invalid URL input format: ${url}`);
     }
     if (scheme === 'blob') {
       const { allow, deny, only } = opt;
@@ -824,12 +825,11 @@ export const sanitizeURLSync = (
   let res;
   if (url && isString(url)) {
     let scheme;
-    try {
-      const { protocol } = new URL(url);
-      scheme = protocol.replace(/:$/, '');
-    } catch (e) {
-      const msg = `Invalid URL input format: ${url}`;
-      logDebug(isDebug, msg, e);
+    const parsedUrl = URL.parse(url);
+    if (parsedUrl) {
+      scheme = parsedUrl.protocol.replace(/:$/, '');
+    } else {
+      logDebug(isDebug, `Invalid URL input format: ${url}`);
     }
     if (scheme === 'blob') {
       if (opt?.revokeObjectURL) {
@@ -854,11 +854,11 @@ export const inspectURL = async url => {
 };
 
 /**
- * @deprecated Use inspectURL instead.
+ * @deprecated Use {@link inspectURL} instead.
  * @param {string} url - The URL string to inspect.
  * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
  */
-export const parseURL = url => inspectURL(url);
+export const parseURL = async url => inspectURL(url);
 
 /**
  * Inspects, parses, and sanitizes the given URL synchronously.
@@ -868,7 +868,7 @@ export const parseURL = url => inspectURL(url);
 export const inspectURLSync = url => urlSanitizer.inspect(url);
 
 /**
- * @deprecated Use inspectURLSync instead.
+ * @deprecated Use {@link inspectURLSync} instead.
  * @param {string} url - The URL string to inspect.
  * @returns {InspectedURLResult} The inspected URL result.
  */

package/src/mjs/uri-util.js

@@ -11,6 +11,7 @@ import { CHUNK_SIZE, DECI, HEX, MAX_BLOB_SIZE, MAX_NEST } from './constant.js';
 import {
   REG_HASH,
   REG_NUM_REF,
+  REG_PCT_ENC,
   REG_QUERY,
   REG_SCHEME_EXT,
   REG_SCRIPT,
@@ -88,18 +89,18 @@ export class URISchemes {
     if (!isString(uri)) {
       return false;
     }
-    try {
-      const { protocol } = new URL(uri.normalize('NFKC'));
-      const scheme = protocol.replace(/:$/, '');
-      const parts = scheme.split('+');
-      const isScript = parts.some(s => REG_SCRIPT.test(s));
-      if (isScript) {
-        return false;
-      }
-      return REG_SCHEME_EXT.test(scheme) || parts.every(s => schemes.has(s));
-    } catch {
+    const normalizedUri = uri.normalize('NFKC');
+    const parsedUrl = URL.parse(normalizedUri);
+    if (!parsedUrl) {
+      return false;
+    }
+    const scheme = parsedUrl.protocol.replace(/:$/, '');
+    const parts = scheme.split('+');
+    const isScript = parts.some(s => REG_SCRIPT.test(s));
+    if (isScript) {
       return false;
     }
+    return REG_SCHEME_EXT.test(scheme) || parts.every(s => schemes.has(s));
   }
 }
 
@@ -113,11 +114,11 @@ export const getURLEncodedString = str => {
     throw new TypeError(`Expected String but got ${getType(str)}.`);
   }
   const bytes = encoder.encode(str);
-  const encoded = [];
+  let encoded = '';
   for (let i = 0; i < bytes.length; i++) {
-    encoded.push(HEX_TABLE[bytes[i]]);
+    encoded += HEX_TABLE[bytes[i]];
   }
-  return encoded.join('');
+  return encoded;
 };
 
 /**
@@ -226,7 +227,7 @@ export const parseURLEncodedNumCharRef = (str, nest = 0) => {
     res = decodeURIComponent(str);
   } catch {
     // Fallback: decode only valid multi-byte %XX sequences.
-    res = str.replace(/(?:%[\dA-F]{2})+/gi, match => {
+    res = str.replace(REG_PCT_ENC, match => {
       try {
         return decodeURIComponent(match);
       } catch {

package/types/mjs/dompurify.d.ts

@@ -1 +1 @@
-export declare const domPurify: import('dompurify');
+export declare const domPurify: import('dompurify').DOMPurify;

package/types/mjs/regexp.d.ts

@@ -11,4 +11,5 @@ export declare const REG_SCRIPT_BLOB: RegExp;
 export declare const REG_TAG_QUOT: RegExp;
 export declare const REG_URL_ENC: RegExp;
 export declare const REG_AMP_ENC: RegExp;
+export declare const REG_PCT_ENC: RegExp;
 export declare const REG_VERIFY_RELATIVE: RegExp;