url-sanitizer 5.2.0 → 5.2.2

package/package.json

@@ -31,7 +31,7 @@
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^30.0.0",
-    "@types/node": "^26.3.0",
+    "@types/node": "^26.4.1",
     "c8": "^12.0.0",
     "chai": "^6.2.2",
     "commander": "^15.0.0",
@@ -39,22 +39,22 @@
     "esbuild": "^0.28.2",
     "eslint": "^10.9.1",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^64.2.1",
+    "eslint-plugin-jsdoc": "^64.3.5",
     "eslint-plugin-prettier": "^5.5.6",
-    "eslint-plugin-regexp": "^3.2.0",
-    "eslint-plugin-unicorn": "^73.0.0",
+    "eslint-plugin-regexp": "^3.3.0",
+    "eslint-plugin-unicorn": "^74.0.0",
     "fast-check": "^4.9.0",
-    "globals": "^17.11.0",
+    "globals": "^17.12.0",
     "http-server": "^14.1.1",
     "mitata": "^1.0.34",
-    "mocha": "^11.8.0",
+    "mocha": "^12.0.0",
     "neostandard": "^0.14.0-next.1",
     "papaparse": "^5.7.0",
     "prettier": "^3.9.6",
     "sinon": "^22.1.0",
     "strict-url-sanitise": "^0.0.1",
     "typescript": "^7.0.2",
-    "undici": "^8.10.0"
+    "undici": "^8.10.1"
   },
   "overrides": {
     "mocha": {
@@ -87,5 +87,5 @@
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
-  "version": "5.2.0"
+  "version": "5.2.2"
 }

package/src/index.js

@@ -8,8 +8,48 @@
 
 import { URLSanitizer } from './mjs/sanitize.js';
 
+/* typedef */
 /**
- * @typedef {import('./mjs/sanitize.js').InspectedURLResult} InspectedURLResult
+ * The parsed result of a Data URL.
+ * @typedef {object} InspectedDataURL
+ * @property {boolean} base64 - Indicates whether the data is base64-encoded.
+ * @property {string} data - The actual data part of the Data URL.
+ * @property {string} mime - The MIME type of the data.
+ */
+
+/**
+ * The result of an inspected URL, extending the standard URL API.
+ * The properties except for input and valid are omitted for invalid URLs.
+ * @typedef {object} InspectedURLResult
+ * @property {string} input - The original URL input.
+ * @property {boolean} valid - Indicates whether the sanitized URL (href) is a valid absolute URL.
+ * @property {string|null} href - The sanitized URL, or null.
+ * @property {boolean} [relative] - Indicates whether the sanitized URL (href) is a valid relative URL.
+ * @property {string} [reason] - The reason why the URL is invalid.
+ * @property {InspectedDataURL|null} [data] - The parsed result of a Data URL, or null.
+ * @property {string} [origin] - The scheme, domain, and port.
+ * @property {string} [protocol] - The protocol scheme.
+ * @property {string} [username] - The specified username.
+ * @property {string} [password] - The specified password.
+ * @property {string} [host] - The domain and port.
+ * @property {string} [hostname] - The domain.
+ * @property {string} [port] - The port number.
+ * @property {string} [pathname] - The path.
+ * @property {string} [search] - The query string.
+ * @property {string} [hash] - The fragment identifier.
+ */
+
+/**
+ * The sanitization options.
+ * @typedef {object} SanitizeOptions
+ * @property {string[]} [allow] - The array of schemes to allow.
+ * @property {string[]} [deny] - The array of schemes to deny. Takes precedence over `allow`.
+ * @property {string[]} [only] - The array of specific schemes to allow. Takes precedence over `allow` and `deny`.
+ * @property {boolean} [allowRelative] - Allow relative URLs.
+ * @property {boolean} [debug] - Enable debug mode.
+ * @property {boolean} [revokeObjectURL] - Revokes the Blob URL after sanitization.
+ * @property {number} [maxBlobSize] - The maximum allowed Blob size in bytes.
+ * @property {number} [maxLength] - The maximum allowed URL length.
  */
 
 export { URLSanitizer };
@@ -23,15 +63,7 @@ const sanitizer = new URLSanitizer();
  * NOTE: `blob`, `data`, and `file` schemes must be explicitly allowed.
  * Given a `blob` URL, it securely converts and returns a sanitized `data` URL.
  * @param {string} url - URL.
- * @param {object} [opt] - options.
- * @param {string[]} [opt.allow] - The array of schemes to allow.
- * @param {string[]} [opt.deny] - The array of schemes to deny.
- * @param {string[]} [opt.only] - The array of specific schemes to allow.
- * @param {boolean} [opt.allowRelative] - Allow relative URLs.
- * @param {boolean} [opt.debug] - Enable debug mode.
- * @param {boolean} [opt.revokeObjectURL] - Revokes the Blob URL after sanitization.
- * @param {number} [opt.maxBlobSize] - The maximum allowed Blob size in bytes.
- * @param {number} [opt.maxLength] - The maximum allowed URL length.
+ * @param {SanitizeOptions} [opt] - The sanitization options.
  * @returns {Promise<string|null>} A promise resolving to the sanitized URL, or null.
  */
 export const sanitizeURL = async (url, opt) => sanitizer.sanitizeURL(url, opt);
@@ -41,14 +73,7 @@ export const sanitizeURL = async (url, opt) => sanitizer.sanitizeURL(url, opt);
  * NOTE: `data` and `file` schemes must be explicitly allowed.
  * The `blob` scheme is not supported and will return `null`.
  * @param {string} url - URL.
- * @param {object} [opt] - options.
- * @param {string[]} [opt.allow] - The array of schemes to allow.
- * @param {string[]} [opt.deny] - The array of schemes to deny.
- * @param {string[]} [opt.only] - The array of specific schemes to allow.
- * @param {boolean} [opt.allowRelative] - Allow relative URLs.
- * @param {boolean} [opt.debug] - Enable debug mode.
- * @param {boolean} [opt.revokeObjectURL] - Revokes the Blob URL.
- * @param {number} [opt.maxLength] - The maximum allowed URL length.
+ * @param {SanitizeOptions} [opt] - The sanitization options.
  * @returns {string|null} The sanitized URL, or null if denied.
  */
 export const sanitizeURLSync = (url, opt) =>

package/src/mjs/constant.js

@@ -69,3 +69,19 @@ export const TYPE_TO = -1;
  * @type {string}
  */
 export const DUMMY_BASE = 'http://dummy.local';
+
+/**
+ * The default sanitization options.
+ * @type {import('./sanitize.js').InternalSanitizeOptions}
+ */
+export const DEFAULT_OPTS = {
+  allow: Object.freeze([]),
+  deny: Object.freeze([]),
+  only: Object.freeze([]),
+  allowRelative: false,
+  debug: false,
+  revokeObjectURL: false,
+  maxBlobSize: MAX_BLOB_SIZE,
+  maxLength: MAX_URL_LENGTH,
+  schemes: new Set()
+};

package/src/mjs/dompurify.js

@@ -2,7 +2,7 @@
  * dompurify.js
  */
 
-import DOMPurify from 'dompurify';
+import createDOMPurify from 'dompurify';
 import { JSDOM } from 'jsdom';
 
 const { window } = new JSDOM('');
@@ -12,4 +12,4 @@ const { window } = new JSDOM('');
  * Used to sanitize HTML/SVG strings.
  * @type {import('dompurify').DOMPurify}
  */
-export const domPurify = DOMPurify(window);
+export const domPurify = createDOMPurify(window);

package/src/mjs/filter.js

@@ -18,8 +18,17 @@ import {
   truncateURL
 } from './utility.js';
 
+/* typedef */
+/**
+ * @typedef {import('dompurify').DOMPurify} DOMPurify
+ * @typedef {import('../index.js').InspectedDataURL} InspectedDataURL
+ * @typedef {import('../index.js').InspectedURLResult} InspectedURLResult
+ * @typedef {import('../index.js').SanitizeOptions} SanitizeOptions
+ * @typedef {import('./sanitize.js').InternalSanitizeOptions} InternalSanitizeOptions
+ */
+
 /* constants */
-import { DUMMY_BASE, MAX_NEST } from './constant.js';
+import { DEFAULT_OPTS, DUMMY_BASE, MAX_NEST } from './constant.js';
 import {
   REG_AMP_ENC,
   REG_MIME_DOM,
@@ -35,10 +44,10 @@ import {
  */
 export class SanitizeContext {
   /**
-   * @param {object} opt - Sanitization options.
-   * @param {object} domPurifyInstance - The DOMPurify instance.
+   * @param {DOMPurify} domPurifyInstance - The DOMPurify instance.
+   * @param {InternalSanitizeOptions} opt - The internal sanitization options.
    */
-  constructor(opt, domPurifyInstance) {
+  constructor(domPurifyInstance, opt = DEFAULT_OPTS) {
     this.domPurify = domPurifyInstance;
     this.nest = 0;
     this.recurse = new Set();
@@ -56,20 +65,18 @@ export class SanitizeContext {
   /**
    * Compiles allow, deny, and only rules into the context.
    * @private
-   * @param {object} opt - Sanitization options.
+   * @param {InternalSanitizeOptions} opt - The internal sanitization options.
    */
-  #compileRules(opt = {}) {
-    const { allowRelative, debug, schemes, allow, deny, only } = opt;
+  #compileRules(opt) {
+    const { allowRelative, debug, allow, deny, only } = opt;
     this.allowRelative = !!allowRelative;
     this.debug = !!debug;
     if (Array.isArray(only) && only.length) {
-      this.schemes = new Set();
       this.restrictScheme = true;
       for (const scheme of only) {
         this.#registerScheme(scheme);
       }
     } else {
-      this.schemes = new Set(schemes || []);
       if (Array.isArray(allow) && allow.length) {
         for (const scheme of allow) {
           this.#registerScheme(scheme);
@@ -110,7 +117,6 @@ export class SanitizeContext {
       }
     }
     this.schemeMap.set(normalizedScheme, true);
-    this.schemes.add(normalizedScheme);
     return true;
   }
 
@@ -149,10 +155,10 @@ export class SanitizeFilter {
   #defaultOpts;
 
   /**
-   * @param {object} options - The default sanitization options.
+   * @param {InternalSanitizeOptions} opt - The default sanitization options.
    */
-  constructor(options) {
-    this.#defaultOpts = options;
+  constructor(opt = DEFAULT_OPTS) {
+    this.#defaultOpts = opt;
   }
 
   /**
@@ -257,29 +263,30 @@ export class SanitizeFilter {
    * @private
    * @param {string} dom - The URL-encoded DOM string.
    * @param {SanitizeContext} ctx - The sanitization context.
-   * @returns {string} The purified DOM string.
+   * @returns {string|null} The purified DOM string or null.
    */
   #purify(dom, ctx) {
-    let decodedDom = dom;
+    let decodedDom = '';
     try {
       decodedDom = decodeURIComponent(dom);
     } catch {
-      // fall through
+      decodedDom = dom;
     }
-    let purifiedDom;
+    const hook = (node, evt) => this.#handleSanitizeAttribute(node, evt, ctx);
+    let purifiedDom = '';
     try {
-      ctx.domPurify.addHook('uponSanitizeAttribute', (node, evt) =>
-        this.#handleSanitizeAttribute(node, evt, ctx)
-      );
+      ctx.domPurify.addHook('uponSanitizeAttribute', hook);
       purifiedDom = ctx.domPurify.sanitize(decodedDom);
     } finally {
-      ctx.domPurify.removeHook('uponSanitizeAttribute');
+      ctx.domPurify.removeHook('uponSanitizeAttribute', hook);
+    }
+    if (!purifiedDom) {
+      return null;
     }
-    purifiedDom = trimTrailingEmptyQueryAndHash(purifiedDom);
     try {
-      return encodeURI(purifiedDom);
+      return encodeURI(trimTrailingEmptyQueryAndHash(purifiedDom));
     } catch {
-      return purifiedDom;
+      return null;
     }
   }
 
@@ -346,14 +353,14 @@ export class SanitizeFilter {
   /**
    * Sanitizes the URL.
    * @param {string} url - The URL string to sanitize.
-   * @param {object} options - Sanitization options.
+   * @param {InternalSanitizeOptions} opt - The internal sanitization options.
    * @returns {string|null} The sanitized URL, or null.
    */
-  sanitize(url, options = this.#defaultOpts) {
+  sanitize(url, opt = this.#defaultOpts) {
     if (!url || !isString(url)) {
       return null;
     }
-    const { deny, maxLength, only, allowRelative } = options;
+    const { deny, maxLength, only, allowRelative } = opt;
     if (Number.isInteger(maxLength) && url.length > maxLength) {
       const msg = `URL length ${url.length} exceeds max length ${maxLength}.`;
       throw new RangeError(msg);
@@ -365,17 +372,17 @@ export class SanitizeFilter {
     // Early return for standard HTTP/HTTPS URLs without restrictive rules.
     if (
       !hasRestrictiveRules &&
-      (url.startsWith('https://') || url.startsWith('http://')) &&
+      /^https?:\/\//.test(url) &&
       !REG_TAG_QUOT.test(url) &&
       !url.includes('data:')
     ) {
       const urlObj = parseURL(url, null, true);
-      if (urlObj && options.schemes.has(urlObj.protocol.replace(/:$/, ''))) {
+      if (urlObj && opt.schemes.has(urlObj.protocol.replace(/:$/, ''))) {
         return urlObj.href.replace(/%26/g, escapeURLEncodedHTMLChars);
       }
       return null;
     }
-    const ctx = new SanitizeContext(options, domPurify);
+    const ctx = new SanitizeContext(domPurify, opt);
     return this.#process(url, ctx);
   }
 
@@ -383,24 +390,22 @@ export class SanitizeFilter {
    * Asynchronously sanitizes an ArrayBuffer and converts it to a Data URL.
    * @param {ArrayBuffer} buffer - The target buffer.
    * @param {string} mimeType - The MIME type of the buffer.
-   * @param {object} options - Sanitization options.
+   * @param {InternalSanitizeOptions} opt - The internal sanitization options.
    * @returns {Promise<string|null>} The sanitized Data URL, or null.
    */
-  async sanitizeBuffer(buffer, mimeType, options = this.#defaultOpts) {
+  async sanitizeBuffer(buffer, mimeType, opt = this.#defaultOpts) {
     if (!(buffer instanceof ArrayBuffer)) {
       return null;
     }
     const base64Data = encodeBufferToBase64(buffer);
-    const dataUrl = `data:${mimeType ? `${mimeType};base64` : 'base64'},${base64Data}`;
-    if (
-      Number.isInteger(options.maxLength) &&
-      dataUrl.length > options.maxLength
-    ) {
+    const mime = mimeType ? `${mimeType};base64` : 'base64';
+    const dataUrl = `data:${mime},${base64Data}`;
+    if (Number.isInteger(opt.maxLength) && dataUrl.length > opt.maxLength) {
       throw new RangeError(
-        `URL length ${dataUrl.length} exceeds max length ${options.maxLength}.`
+        `URL length ${dataUrl.length} exceeds max length ${opt.maxLength}.`
       );
     }
-    const ctx = new SanitizeContext(options, domPurify);
+    const ctx = new SanitizeContext(domPurify, opt);
     if (!ctx.schemeMap.get('data')) {
       return null;
     }
@@ -414,14 +419,14 @@ export class SanitizeFilter {
   /**
    * Asynchronously sanitizes the Data URL.
    * @param {string} url - The URL string to sanitize.
-   * @param {object} options - Sanitization options.
+   * @param {InternalSanitizeOptions} opt - The internal sanitization options.
    * @returns {Promise<string|null>} The sanitized Data URL, or null.
    */
-  async sanitizeDataURL(url, options = this.#defaultOpts) {
+  async sanitizeDataURL(url, opt = this.#defaultOpts) {
     if (!url || !isString(url)) {
       return null;
     }
-    const { maxLength } = options;
+    const { maxLength } = opt;
     if (Number.isInteger(maxLength) && url.length > maxLength) {
       throw new RangeError(
         `URL length ${url.length} exceeds max length ${maxLength}.`
@@ -435,7 +440,7 @@ export class SanitizeFilter {
     if (scheme !== 'data') {
       return null;
     }
-    const ctx = new SanitizeContext(options, domPurify);
+    const ctx = new SanitizeContext(domPurify, opt);
     if (!ctx.schemeMap.get(scheme)) {
       return null;
     }

package/src/mjs/sanitize.js

@@ -15,8 +15,9 @@ import {
 } from './utility.js';
 
 /* constants */
-import { DECI, MAX_BLOB_SIZE, MAX_URL_LENGTH } from './constant.js';
+import { DECI, DEFAULT_OPTS, MAX_BLOB_SIZE } from './constant.js';
 import { REG_SCHEME, REG_SCRIPT, REG_SCRIPT_OR_BLOB } from './regexp.js';
+/* @type {string[]} */
 const URL_PROPS = Object.freeze([
   'href',
   'origin',
@@ -30,46 +31,17 @@ const URL_PROPS = Object.freeze([
   'search',
   'hash'
 ]);
-const DEFAULT_OPTS = Object.freeze({
-  allow: Object.freeze([]),
-  deny: Object.freeze([]),
-  only: Object.freeze([]),
-  allowRelative: false,
-  debug: false,
-  revokeObjectURL: false,
-  maxBlobSize: MAX_BLOB_SIZE,
-  maxLength: MAX_URL_LENGTH
-});
 
 /* typedef */
 /**
- * The parsed result of a Data URL.
- * @typedef {object} InspectedDataURL
- * @property {boolean} base64 - Indicates whether the data is base64-encoded.
- * @property {string} data - The actual data part of the Data URL.
- * @property {string} mime - The MIME type of the data.
+ * @typedef {import('../index.js').InspectedDataURL} InspectedDataURL
+ * @typedef {import('../index.js').InspectedURLResult} InspectedURLResult
+ * @typedef {import('../index.js').SanitizeOptions} SanitizeOptions
  */
 
 /**
- * The result of an inspected URL, extending the standard URL API.
- * The properties except for input and valid are omitted for invalid URLs.
- * @typedef {object} InspectedURLResult
- * @property {string} input - The original URL input.
- * @property {boolean} valid - Indicates whether the sanitized URL (href) is a valid absolute URL.
- * @property {string|null} href - The sanitized URL, or null.
- * @property {boolean} [relative] - Indicates whether the sanitized URL (href) is a valid relative URL.
- * @property {string} [reason] - The reason why the URL is invalid.
- * @property {InspectedDataURL|null} [data] - The parsed result of a Data URL, or null.
- * @property {string} [origin] - The scheme, domain, and port.
- * @property {string} [protocol] - The protocol scheme.
- * @property {string} [username] - The specified username.
- * @property {string} [password] - The specified password.
- * @property {string} [host] - The domain and port.
- * @property {string} [hostname] - The domain.
- * @property {string} [port] - The port number.
- * @property {string} [pathname] - The path.
- * @property {string} [search] - The query string.
- * @property {string} [hash] - The fragment identifier.
+ * Internal sanitization options.
+ * @typedef {SanitizeOptions & { schemes?: Set<string> }} InternalSanitizeOptions
  */
 
 /* blob handlers */
@@ -114,6 +86,7 @@ const readStreamInChunksAsArrayBuffer = async (response, maxSize) => {
 
 /**
  * Fetches a Blob URL and extracts its ArrayBuffer and MIME type.
+ * @private
  * @param {string} url - The Blob URL to fetch.
  * @param {number} [maxBlobSize] - The maximum allowed Blob size in bytes.
  * @returns {Promise<{ buffer: ArrayBuffer, mimeType: string }>} A promise resolving to the buffer and MIME type.
@@ -210,11 +183,11 @@ export class URLSanitizer extends URISchemes {
    * Normalizes options and evaluates preliminary scheme routing.
    * @private
    * @param {string} url - The URL string.
-   * @param {object} opt - User options.
-   * @returns {{ isValid: boolean|undefined, options: object, scheme: string|null }} Nomalized options, scheme, and isValid.
+   * @param {SanitizeOptions} [opt] - The sanitization options.
+   * @returns {{ isValid: boolean|undefined, options: InternalSanitizeOptions, scheme: string|null }} Normalized options, scheme, and isValid.
    */
   #normalizeOptions(url, opt = {}) {
-    if (!url || !isString(url)) {
+    if (!isString(url) || url === '') {
       return { isValid: false };
     }
     const options = {
@@ -258,7 +231,8 @@ export class URLSanitizer extends URISchemes {
       sanitizedURL = this.#filter.sanitize(url, {
         ...this.#defaultOpts,
         allow: ['data'],
-        allowRelative: true
+        allowRelative: true,
+        schemes: this.#allowedSchemes
       });
       if (!sanitizedURL) {
         invalidReason =
@@ -366,23 +340,18 @@ export class URLSanitizer extends URISchemes {
    * @returns {void}
    */
   reset() {
-    this.#allowedSchemes = new Set(super.get());
+    this.#allowedSchemes.clear();
+    for (const scheme of super.get()) {
+      this.#allowedSchemes.add(scheme);
+    }
   }
 
   /**
    * Asynchronously sanitizes the given URL.
    * NOTE: `blob`, `data`, and `file` schemes must be explicitly allowed.
    * Given a `blob` URL, it securely converts and returns a sanitized `data` URL.
-   * @param {string} url - URL.
-   * @param {object} [opt] - options.
-   * @param {string[]} [opt.allow] - The array of schemes to allow.
-   * @param {string[]} [opt.deny] - The array of schemes to deny.
-   * @param {string[]} [opt.only] - The array of specific schemes to allow.
-   * @param {boolean} [opt.allowRelative] - Allow relative URLs.
-   * @param {boolean} [opt.debug] - Enable debug mode.
-   * @param {boolean} [opt.revokeObjectURL] - Revokes the Blob URL after sanitization.
-   * @param {number} [opt.maxBlobSize] - The maximum allowed Blob size in bytes.
-   * @param {number} [opt.maxLength] - The maximum allowed URL length.
+   * @param {string} url - URL
+   * @param {SanitizeOptions} [opt] - The sanitization options.
    * @returns {Promise<string|null>} A promise resolving to the sanitized URL, or null.
    */
   async sanitizeURL(url, opt) {
@@ -393,47 +362,50 @@ export class URLSanitizer extends URISchemes {
     if (scheme === 'blob') {
       const { allow, deny, only } = options;
       let sanitizedData = null;
-      if (
-        (allow.includes('blob') && !deny.includes('blob')) ||
-        only.includes('blob')
-      ) {
-        let fetchedBuffer = null;
-        let fetchedMimeType = '';
-        try {
-          const fetchResult = await fetchBlobAsArrayBuffer(
-            url,
-            options.maxBlobSize
-          );
-          fetchedBuffer = fetchResult.buffer;
-          fetchedMimeType = fetchResult.mimeType;
-        } catch (e) {
-          if (options.debug) {
-            logDebug(
-              `Failed to fetch and convert blob URL: ${truncateURL(url)}`,
-              e
+      try {
+        if (
+          (allow.includes('blob') && !deny.includes('blob')) ||
+          only.includes('blob')
+        ) {
+          let fetchedBuffer = null;
+          let fetchedMimeType = '';
+          try {
+            const fetchResult = await fetchBlobAsArrayBuffer(
+              url,
+              options.maxBlobSize
             );
-          }
-        }
-        if (fetchedBuffer) {
-          if (only.length) {
-            if (!only.includes('data')) {
-              options.only = [...only, 'data'];
+            fetchedBuffer = fetchResult.buffer;
+            fetchedMimeType = fetchResult.mimeType;
+          } catch (e) {
+            if (options.debug) {
+              logDebug(
+                `Failed to fetch and convert blob URL: ${truncateURL(url)}`,
+                e
+              );
             }
-          } else {
-            if (!allow.includes('data')) {
-              options.allow = [...allow, 'data'];
+          }
+          if (fetchedBuffer) {
+            if (only.length) {
+              if (!only.includes('data')) {
+                options.only = [...only, 'data'];
+              }
+            } else {
+              if (!allow.includes('data')) {
+                options.allow = [...allow, 'data'];
+              }
+              options.deny = deny.filter(s => s !== 'data');
             }
-            options.deny = deny.filter(s => s !== 'data');
+            sanitizedData = await this.#filter.sanitizeBuffer(
+              fetchedBuffer,
+              fetchedMimeType,
+              options
+            );
           }
-          sanitizedData = await this.#filter.sanitizeBuffer(
-            fetchedBuffer,
-            fetchedMimeType,
-            options
-          );
         }
-      }
-      if (options.revokeObjectURL) {
-        URL.revokeObjectURL(url);
+      } finally {
+        if (options.revokeObjectURL) {
+          URL.revokeObjectURL(url);
+        }
       }
       return sanitizedData;
     } else if (scheme === 'data') {
@@ -447,14 +419,7 @@ export class URLSanitizer extends URISchemes {
    * NOTE: `data` and `file` schemes must be explicitly allowed.
    * The `blob` scheme is not supported and will return `null`.
    * @param {string} url - URL.
-   * @param {object} [opt] - options.
-   * @param {string[]} [opt.allow] - The array of schemes to allow.
-   * @param {string[]} [opt.deny] - The array of schemes to deny.
-   * @param {string[]} [opt.only] - The array of specific schemes to allow.
-   * @param {boolean} [opt.allowRelative] - Allow relative URLs.
-   * @param {boolean} [opt.debug] - Enable debug mode.
-   * @param {boolean} [opt.revokeObjectURL] - Revokes the Blob URL.
-   * @param {number} [opt.maxLength] - The maximum allowed URL length.
+   * @param {SanitizeOptions} [opt] - The sanitization options.
    * @returns {string|null} The sanitized URL, or null if denied.
    */
   sanitizeURLSync(url, opt) {

package/src/mjs/scheme.js

@@ -123,10 +123,10 @@ export class URISchemes {
    * @returns {boolean} True if the parsed URL is valid and permitted.
    */
   verifyScheme(scheme, schemes, allowCustom = false) {
-    if (!isString(scheme)) {
+    const normalized = this.normalize(scheme, true);
+    if (!normalized) {
       return false;
     }
-    const normalized = this.normalize(scheme, true);
     const targetSchemes = schemes || this.#schemes;
     if (!normalized.includes('+')) {
       if (REG_SCRIPT.test(normalized)) {

package/src/mjs/text-chars.js

@@ -49,7 +49,7 @@ export const WINDOWS1252_TO_UNICODE = new Map([
 /**
  * Generates hexadecimal escape strings for non-text codes.
  * @private
- * @returns {Map<number, string>} The map of non-text codes and hexadicimal escape strings.
+ * @returns {Map<number, string>} The map of non-text codes and hexadecimal escape strings.
  */
 const generateNonTextCharCodes = () => {
   const charCodes = new Map();