url-sanitizer 4.2.2 → 5.0.0

package/package.json

@@ -25,52 +25,49 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "dompurify": "^3.4.12",
-    "jsdom": "^29.1.1"
+    "dompurify": "^3.4.13",
+    "jsdom": "^30.0.1"
   },
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.2",
-    "@types/jsdom": "^28.0.3",
-    "@types/node": "^26.1.1",
+    "@types/jsdom": "^30.0.0",
+    "@types/node": "^26.2.0",
     "c8": "^12.0.0",
     "chai": "^6.2.2",
     "commander": "^15.0.0",
     "copyfiles-ng": "^2.4.7",
-    "esbuild": "^0.28.1",
+    "esbuild": "^0.28.2",
     "eslint": "^9.39.5",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^63.3.0",
+    "eslint-plugin-jsdoc": "^64.1.0",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-regexp": "^3.1.1",
     "eslint-plugin-unicorn": "^64.0.0",
     "fast-check": "^4.9.0",
-    "globals": "^17.8.0",
+    "globals": "^17.11.0",
     "http-server": "^14.1.1",
     "mitata": "^1.0.34",
-    "mocha": "^11.7.6",
+    "mocha": "^11.8.0",
     "neostandard": "^0.13.0",
     "papaparse": "^5.5.4",
     "prettier": "^3.9.6",
     "sinon": "^22.1.0",
     "strict-url-sanitise": "^0.0.1",
     "typescript": "^7.0.2",
-    "undici": "^8.9.0"
+    "undici": "^8.10.0"
   },
   "overrides": {
-    "c8": {
-      "yargs": "^18.0.0"
-    },
     "eslint": {
-      "js-yaml": "^4.3.0"
+      "js-yaml": "^4.3.1"
     },
     "mocha": {
       "diff": "^8.0.3",
-      "js-yaml": "^4.3.0"
-    },
-    "serialize-javascript": "^7.0.4"
+      "js-yaml": "^4.3.1",
+      "serialize-javascript": "^7.0.7"
+    }
   },
   "allowScripts": {
-    "esbuild@0.28.1": true
+    "esbuild@0.28.2": true
   },
   "scripts": {
     "bench": "node benchmark/benchmark.js",
@@ -91,7 +88,7 @@
     "tsc": "node scripts/index clean --dir=types -i && npx tsc"
   },
   "engines": {
-    "node": ">=22.13"
+    "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
-  "version": "4.2.2"
+  "version": "5.0.0"
 }

package/src/index.js

@@ -9,11 +9,8 @@
 export {
   default,
   inspectURL,
-  inspectURLSync,
-  isURI,
-  isURISync,
-  parseURL,
-  parseURLSync,
+  isURISync, // deprecated
+  isValidURI,
   sanitizeURL,
   sanitizeURLSync
 } from './mjs/sanitizer.js';

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]
+["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","aet","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","cm","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","gcx","gdsi","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","pkg","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/constant.js

@@ -2,6 +2,12 @@
  * constant.js
  */
 
+/**
+ * The total number of 8-bit byte values (0x00–0xFF).
+ * @type {number}
+ */
+export const BYTE_RANGE = 256;
+
 /**
  * Chunk size (8KB) used when processing byte arrays to avoid stack overflow.
  * @type {number}
@@ -32,6 +38,18 @@ export const MAX_BLOB_SIZE = 16 * 1024 * 1024;
  */
 export const MAX_NEST = 16;
 
+/**
+ * Maximum URL length (64KB).
+ * @type {number}
+ */
+export const MAX_URL_LENGTH = 64 * 1024;
+
+/**
+ * Length used for truncating string.
+ * @type {number}
+ */
+export const TRUNCATE_LENGTH = 64;
+
 /**
  * Start index used to extract the type name from Object.prototype.toString().
  * (e.g. removes "[object " prefix)

package/src/mjs/regexp.js

@@ -12,7 +12,7 @@ export const REG_CHARSET = /^charset\s*=\s*(["']?)(?<name>[\w:-]+)\1$/;
  * Matches a trailing empty fragment identifier (#).
  * @type {RegExp}
  */
-export const REG_HASH = /(?:#|%23)$/;
+export const REG_HASH = /#$/;
 
 /**
  * Matches MIME types that contain DOM-parsable content (HTML, XML, SVG).
@@ -25,10 +25,10 @@ export const REG_MIME_DOM =
  * Matches general text MIME types.
  * @type {RegExp}
  */
-export const REG_MIME_TEXT = /^text\/[\w#&.;-]+/;
+export const REG_MIME_TEXT = /^text\/[\w#&.;+-]+/i;
 
 /**
- * Matches numeric character reference.
+ * Matches numeric character references (hex or decimal).
  * @type {RegExp}
  */
 export const REG_NUM_REF = /&#(x0*[\dA-F]{1,2}|0*\d{1,3});?/gi;
@@ -37,7 +37,7 @@ export const REG_NUM_REF = /&#(x0*[\dA-F]{1,2}|0*\d{1,3});?/gi;
  * Matches a trailing empty query string (?), ensuring it is not part of a hash.
  * @type {RegExp}
  */
-export const REG_QUERY = /^((?:[^#%]|%(?!23))*)(?:\?|%3F)$/i;
+export const REG_QUERY = /^((?:[^#%]|%(?!23))*)\?$/;
 
 /**
  * Validates a string against standard IANA URI scheme syntax.
@@ -63,10 +63,10 @@ export const REG_SCRIPT = /^(?:java|vb)script$/i;
  * Matches script-executing or data-fetching schemes.
  * @type {RegExp}
  */
-export const REG_SCRIPT_BLOB = /^(?:(?:java|vb)script|blob)$/i;
+export const REG_SCRIPT_OR_BLOB = /^(?:(?:java|vb)script|blob)$/i;
 
 /**
- * Matches HTML tags, quotes, and their encoded or character reference variants.
+ * Matches HTML-sensitive characters and their encoded variants.
  * @type {RegExp}
  */
 export const REG_TAG_QUOT =
@@ -79,19 +79,25 @@ export const REG_TAG_QUOT =
 export const REG_URL_ENC = /^%[\dA-F]{2}$/i;
 
 /**
- * Matches an ampersand-encoded character (&foo).
+ * Matches one or more consecutive percent-encoded sequences (%20, %E3%81%82).
  * @type {RegExp}
  */
-export const REG_AMP_ENC = /&(?=[#a-z0-9])(?![a-z0-9]+=)/i;
+export const REG_PCT_ENC = /(?:%[\dA-F]{2})+/gi;
 
 /**
- * Match one or more consecutive URL percent-encoded sequences (%20, %E3%81%82).
+ * Matches HTML-encoded ampersands.
  * @type {RegExp}
  */
-export const REG_PCT_ENC = /(?:%[\dA-F]{2})+/gi;
+export const REG_AMP = /&amp;/gi;
+
+/**
+ * Matches ampersand that may begin an HTML entity reference.
+ * @type {RegExp}
+ */
+export const REG_AMP_ENC = /&(?=[#a-z0-9])(?![a-z0-9]+=)/i;
 
 /**
- * Validates relative URLs and flags invalid patterns.
+ * Matches invalid relative URL patterns.
  * @type {RegExp}
  */
 export const REG_VERIFY_RELATIVE = /^(?:\/{2,}|\\|[a-z][a-z\d+\-.]*:[^/])/i;