url-sanitizer 4.2.0 → 4.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +4 -4
  2. package/package.json +2 -2
package/README.md CHANGED
@@ -427,17 +427,17 @@ Unpredictable AI outputs introduce unique security risks, and `url-sanitizer` is
427
427
 
428
428
  ### Defending Against Complex & Obfuscated Payloads
429
429
  LLMs can generate highly complex, nested, or Base64-encoded `data:` URLs — either through prompt injection, RAG data poisoning, or simply reproducing obfuscated code from their training data.
430
- Because `url-sanitizer` performs **Deep Data URL Inspection** — decoding the payload, purifying the inner HTML/SVG tree via DOMPurify, and re-encoding it — it physically neutralizes hidden XSS vectors, ensuring that AI-generated data URLs are safe to render.
430
+ Because `url-sanitizer` performs **Deep Data URL Inspection** — decoding the payload, purifying the inner HTML/SVG tree via DOMPurify, and re-encoding it — it effectively neutralizes hidden XSS vectors, ensuring that AI-generated data URLs are safe to render.
431
431
 
432
432
  ### Neutralizing Hallucinated Schemes
433
433
  LLMs generate URLs based on statistical linguistic patterns rather than factual databases.
434
434
  As a result, they frequently hallucinate plausible-looking but non-existent or hazardous URI schemes (e.g., `ai-agent://`, `host-settings:`).
435
- By operating on a **Secure by Default** whitelist approach, `url-sanitizer` automatically denies any unrecognized or unregistered protocols.
436
- This strict blocking prevents hallucinated schemes from inadvertently triggering application-specific or OS-level protocol hijacking.
435
+ By operating on a whitelist approach, `url-sanitizer` automatically denies any unrecognized or unregistered protocols.
436
+ This strict blocking prevents non-existent or hallucinated schemes from inadvertently triggering application-specific or OS-level protocol hijacking.
437
437
 
438
438
  ## Performance
439
439
 
440
- Execution times were measured using [mitata](https://github.com/evanwashere/mitata) on Node.js[cite: 9].
440
+ Execution times were measured using [mitata](https://github.com/evanwashere/mitata) on Node.js.
441
441
 
442
442
  ### Benchmark Results
443
443
 
package/package.json CHANGED
@@ -54,7 +54,7 @@
54
54
  "sinon": "^22.1.0",
55
55
  "strict-url-sanitise": "^0.0.1",
56
56
  "typescript": "^7.0.2",
57
- "undici": "^7.29.0"
57
+ "undici": "^8.9.0"
58
58
  },
59
59
  "overrides": {
60
60
  "c8": {
@@ -93,5 +93,5 @@
93
93
  "engines": {
94
94
  "node": ">=22.13"
95
95
  },
96
- "version": "4.2.0"
96
+ "version": "4.2.1"
97
97
  }