url-sanitizer 5.2.0 → 5.2.1

package/package.json

@@ -87,5 +87,5 @@
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
-  "version": "5.2.0"
+  "version": "5.2.1"
 }

package/src/mjs/sanitize.js

@@ -213,8 +213,8 @@ export class URLSanitizer extends URISchemes {
    * @param {object} opt - User options.
    * @returns {{ isValid: boolean|undefined, options: object, scheme: string|null }} Nomalized options, scheme, and isValid.
    */
-  #normalizeOptions(url, opt = {}) {
-    if (!url || !isString(url)) {
+  #normalizeOptions(url, opt) {
+    if (!isString(url) || url === '') {
       return { isValid: false };
     }
     const options = {
@@ -258,7 +258,8 @@ export class URLSanitizer extends URISchemes {
       sanitizedURL = this.#filter.sanitize(url, {
         ...this.#defaultOpts,
         allow: ['data'],
-        allowRelative: true
+        allowRelative: true,
+        schemes: this.#allowedSchemes
       });
       if (!sanitizedURL) {
         invalidReason =
@@ -366,7 +367,10 @@ export class URLSanitizer extends URISchemes {
    * @returns {void}
    */
   reset() {
-    this.#allowedSchemes = new Set(super.get());
+    this.#allowedSchemes.clear();
+    for (const scheme of super.get()) {
+      this.#allowedSchemes.add(scheme);
+    }
   }
 
   /**
@@ -386,7 +390,7 @@ export class URLSanitizer extends URISchemes {
    * @returns {Promise<string|null>} A promise resolving to the sanitized URL, or null.
    */
   async sanitizeURL(url, opt) {
-    const { isValid, options, scheme } = this.#normalizeOptions(url, opt);
+    const { isValid, options, scheme } = this.#normalizeOptions(url, opt ?? {});
     if (isValid === false) {
       return null;
     }
@@ -458,7 +462,7 @@ export class URLSanitizer extends URISchemes {
    * @returns {string|null} The sanitized URL, or null if denied.
    */
   sanitizeURLSync(url, opt) {
-    const { isValid, options, scheme } = this.#normalizeOptions(url, opt);
+    const { isValid, options, scheme } = this.#normalizeOptions(url, opt ?? {});
     if (isValid === false) {
       return null;
     }

package/src/mjs/scheme.js

@@ -123,10 +123,10 @@ export class URISchemes {
    * @returns {boolean} True if the parsed URL is valid and permitted.
    */
   verifyScheme(scheme, schemes, allowCustom = false) {
-    if (!isString(scheme)) {
+    const normalized = this.normalize(scheme, true);
+    if (!normalized) {
       return false;
     }
-    const normalized = this.normalize(scheme, true);
     const targetSchemes = schemes || this.#schemes;
     if (!normalized.includes('+')) {
       if (REG_SCRIPT.test(normalized)) {

package/src/mjs/text-chars.js

@@ -49,7 +49,7 @@ export const WINDOWS1252_TO_UNICODE = new Map([
 /**
  * Generates hexadecimal escape strings for non-text codes.
  * @private
- * @returns {Map<number, string>} The map of non-text codes and hexadicimal escape strings.
+ * @returns {Map<number, string>} The map of non-text codes and hexadecimal escape strings.
  */
 const generateNonTextCharCodes = () => {
   const charCodes = new Map();