url-sanitizer 5.2.2 → 5.3.0

package/package.json

@@ -25,43 +25,36 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "dompurify": "^3.4.14",
-    "jsdom": "^30.0.1"
+    "dompurify": "^3.4.16",
+    "jsdom": "^30.1.1"
   },
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^30.0.0",
-    "@types/node": "^26.4.1",
+    "@types/node": "^26.6.3",
     "c8": "^12.0.0",
     "chai": "^6.2.2",
     "commander": "^15.0.0",
     "copyfiles-ng": "^2.4.7",
     "esbuild": "^0.28.2",
-    "eslint": "^10.9.1",
+    "eslint": "^10.11.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^64.3.5",
+    "eslint-plugin-jsdoc": "^64.5.4",
     "eslint-plugin-prettier": "^5.5.6",
-    "eslint-plugin-regexp": "^3.3.0",
-    "eslint-plugin-unicorn": "^74.0.0",
-    "fast-check": "^4.9.0",
+    "eslint-plugin-regexp": "^3.3.1",
+    "eslint-plugin-unicorn": "^76.0.0",
+    "fast-check": "^4.10.2",
     "globals": "^17.12.0",
     "http-server": "^14.1.1",
     "mitata": "^1.0.34",
-    "mocha": "^12.0.0",
+    "mocha": "^12.0.2",
     "neostandard": "^0.14.0-next.1",
     "papaparse": "^5.7.0",
-    "prettier": "^3.9.6",
+    "prettier": "^3.9.9",
     "sinon": "^22.1.0",
     "strict-url-sanitise": "^0.0.1",
     "typescript": "^7.0.2",
-    "undici": "^8.10.1"
-  },
-  "overrides": {
-    "mocha": {
-      "diff": "^8.0.3",
-      "js-yaml": "^4.3.1",
-      "serialize-javascript": "^7.0.7"
-    }
+    "undici": "^8.11.2"
   },
   "allowScripts": {
     "esbuild@0.28.2": true
@@ -87,5 +80,5 @@
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
-  "version": "5.2.2"
+  "version": "5.3.0"
 }

package/src/index.js

@@ -42,6 +42,7 @@ import { URLSanitizer } from './mjs/sanitize.js';
 /**
  * The sanitization options.
  * @typedef {object} SanitizeOptions
+ * @property {AbortSignal} [signal] - An AbortSignal to cancel the operation.
  * @property {string[]} [allow] - The array of schemes to allow.
  * @property {string[]} [deny] - The array of schemes to deny. Takes precedence over `allow`.
  * @property {string[]} [only] - The array of specific schemes to allow. Takes precedence over `allow` and `deny`.

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","acr","adiumxtra","adt","aet","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","ars","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","cm","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","gcx","gdsi","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","interaction","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","pkg","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","sarif","secondlife","secret-token","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]
+["aaa","aaas","about","acap","acct","acd","ace","acr","adiumxtra","adt","aet","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","ars","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","cm","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","gcx","gdsi","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","interaction","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","pkg","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","rttp","sarif","secondlife","secret-token","seki","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tii","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/sanitize.js

@@ -9,13 +9,14 @@ import { URISchemes } from './scheme.js';
 import {
   encodeBufferToBase64,
   extractDataURLComponents,
+  fetchBlobAsArrayBuffer,
   normalizeURL,
   parseURL,
   truncateURL
 } from './utility.js';
 
 /* constants */
-import { DECI, DEFAULT_OPTS, MAX_BLOB_SIZE } from './constant.js';
+import { DEFAULT_OPTS } from './constant.js';
 import { REG_SCHEME, REG_SCRIPT, REG_SCRIPT_OR_BLOB } from './regexp.js';
 /* @type {string[]} */
 const URL_PROPS = Object.freeze([
@@ -44,98 +45,6 @@ const URL_PROPS = Object.freeze([
  * @typedef {SanitizeOptions & { schemes?: Set<string> }} InternalSanitizeOptions
  */
 
-/* blob handlers */
-/**
- * Reads a stream in chunks and generates an ArrayBuffer.
- * @private
- * @param {Response} response - The Response instance.
- * @param {number} maxSize - The maximum allowed size in bytes.
- * @returns {Promise<ArrayBuffer>} A promise resolving to the generated ArrayBuffer.
- */
-const readStreamInChunksAsArrayBuffer = async (response, maxSize) => {
-  const reader = response.body.getReader();
-  const chunks = [];
-  try {
-    let accumulatedSize = 0;
-    while (accumulatedSize <= maxSize) {
-      const { done, value } = await reader.read();
-      if (done) {
-        break;
-      }
-      accumulatedSize += value.byteLength;
-      if (accumulatedSize > maxSize) {
-        await reader.cancel('Size limit exceeded');
-        throw new DOMException(
-          `Payload (${accumulatedSize} bytes) exceeds max (${maxSize} bytes).`,
-          'NotReadableError'
-        );
-      }
-      chunks.push(value);
-    }
-    const combined = new Uint8Array(accumulatedSize);
-    let offset = 0;
-    for (const chunk of chunks) {
-      combined.set(chunk, offset);
-      offset += chunk.byteLength;
-    }
-    return combined.buffer;
-  } finally {
-    reader.releaseLock();
-  }
-};
-
-/**
- * Fetches a Blob URL and extracts its ArrayBuffer and MIME type.
- * @private
- * @param {string} url - The Blob URL to fetch.
- * @param {number} [maxBlobSize] - The maximum allowed Blob size in bytes.
- * @returns {Promise<{ buffer: ArrayBuffer, mimeType: string }>} A promise resolving to the buffer and MIME type.
- */
-const fetchBlobAsArrayBuffer = async (url, maxBlobSize) => {
-  let maxSize = MAX_BLOB_SIZE;
-  if (Number.isInteger(maxBlobSize) && maxBlobSize > 0) {
-    maxSize = maxBlobSize;
-  }
-  const response = await fetch(url);
-  if (!response.ok) {
-    const truncatedURL = truncateURL(url);
-    let msg = `Failed to fetch ${truncatedURL}`;
-    if (Number.isInteger(response.status)) {
-      if (response.statusText) {
-        msg += `: ${response.status} ${response.statusText}`;
-      } else {
-        msg += `: ${response.status}`;
-      }
-    }
-    throw new Error(msg);
-  }
-  const contentLength = response.headers.get('content-length');
-  if (contentLength) {
-    const parsedLength = Number.parseInt(contentLength, DECI);
-    if (Number.isInteger(parsedLength) && parsedLength > maxSize) {
-      throw new DOMException(
-        `Payload (${parsedLength} bytes) exceeds max (${maxSize} bytes).`,
-        'NotReadableError'
-      );
-    }
-  }
-  const mimeType = response.headers.get('content-type') || '';
-  let buffer;
-  if (response.body) {
-    buffer = await readStreamInChunksAsArrayBuffer(response, maxSize);
-  } else {
-    const blob = await response.blob();
-    if (blob.size > maxSize) {
-      throw new DOMException(
-        `Payload (${blob.size} bytes) exceeds max (${maxSize} bytes).`,
-        'NotReadableError'
-      );
-    }
-    buffer = await blob.arrayBuffer();
-  }
-  return { buffer, mimeType };
-};
-
 /**
  * URL sanitizer
  */
@@ -284,6 +193,40 @@ export class URLSanitizer extends URISchemes {
     return inspectedURL;
   }
 
+  /**
+   * Inspects a blob URL by reading its buffer and converting it.
+   * @private
+   * @param {string} url - The blob URL.
+   * @param {InternalSanitizeOptions} options - Sanitization options.
+   * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
+   */
+  async #inspectBlob(url, options) {
+    try {
+      const { buffer, mimeType } = await fetchBlobAsArrayBuffer(
+        url,
+        options.maxBlobSize,
+        options.signal
+      );
+      const base64Data = encodeBufferToBase64(buffer);
+      const dataURL = `data:${mimeType ? `${mimeType};base64` : 'base64'},${base64Data}`;
+      const result = this.#inspect(dataURL, options);
+      result.input = url;
+      return result;
+    } catch (e) {
+      if (e.name === 'AbortError' || options.signal?.aborted) {
+        throw e;
+      }
+      if (options.debug) {
+        logDebug(`Failed to inspect blob URL: ${truncateURL(url)}`, e);
+      }
+      return { input: url, valid: false, reason: e.message };
+    } finally {
+      if (options.revokeObjectURL) {
+        URL.revokeObjectURL(url);
+      }
+    }
+  }
+
   /**
    * Gets the list of registered URI schemes.
    * @returns {string[]} An array of registered schemes.
@@ -372,11 +315,15 @@ export class URLSanitizer extends URISchemes {
           try {
             const fetchResult = await fetchBlobAsArrayBuffer(
               url,
-              options.maxBlobSize
+              options.maxBlobSize,
+              options.signal
             );
             fetchedBuffer = fetchResult.buffer;
             fetchedMimeType = fetchResult.mimeType;
           } catch (e) {
+            if (e.name === 'AbortError' || options.signal?.aborted) {
+              throw e;
+            }
             if (options.debug) {
               logDebug(
                 `Failed to fetch and convert blob URL: ${truncateURL(url)}`,
@@ -438,29 +385,16 @@ export class URLSanitizer extends URISchemes {
 
   /**
    * Sanitizes the given URL and returns its parsed components.
-   * NOTE: Blob URLs are not revoked after inspection.
    * @param {string} url - The URL string to inspect.
+   * @param {SanitizeOptions} [opt] - The sanitization options.
    * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
    */
-  async inspectURL(url) {
-    if (isString(url)) {
-      const parsedURL = parseURL(url, null, true);
-      if (parsedURL?.protocol === 'blob:') {
-        try {
-          const { buffer, mimeType } = await fetchBlobAsArrayBuffer(
-            parsedURL.href
-          );
-          const base64Data = encodeBufferToBase64(buffer);
-          const dataURL = `data:${mimeType ? `${mimeType};base64` : 'base64'},${base64Data}`;
-          const inspectedURLResult = this.#inspect(dataURL);
-          inspectedURLResult.input = url;
-          return inspectedURLResult;
-        } catch (e) {
-          return { input: url, valid: false, reason: e.message };
-        }
-      }
+  async inspectURL(url, opt) {
+    const { options, scheme } = this.#normalizeOptions(url, opt);
+    if (scheme === 'blob') {
+      return this.#inspectBlob(url, options);
     }
-    return this.#inspect(url);
+    return this.#inspect(url, options);
   }
 
   /**

package/src/mjs/utility.js

@@ -11,6 +11,7 @@ import {
   CHUNK_SIZE,
   DECI,
   HEX,
+  MAX_BLOB_SIZE,
   MAX_NEST,
   MAX_URL_LENGTH,
   TRUNCATE_LENGTH
@@ -347,3 +348,116 @@ export const encodeBufferToBase64 = buffer => {
   }
   return btoa(chunks.join(''));
 };
+
+/**
+ * Reads a stream in chunks and generates an ArrayBuffer.
+ * @param {Response} response - The Response instance.
+ * @param {number} maxSize - The maximum allowed size in bytes.
+ * @param {AbortSignal} [signal] - The abort signal.
+ * @returns {Promise<ArrayBuffer>} A promise resolving to the generated ArrayBuffer.
+ */
+export const readStreamInChunksAsArrayBuffer = async (
+  response,
+  maxSize,
+  signal
+) => {
+  const reader = response.body.getReader();
+  const chunks = [];
+  const abortMsg = 'Operation aborted';
+  if (signal?.aborted) {
+    await reader.cancel(abortMsg);
+    reader.releaseLock();
+    throw signal.reason;
+  }
+  const onAbort = () => {
+    reader.cancel(abortMsg).catch(() => {});
+  };
+  signal?.addEventListener('abort', onAbort, { once: true });
+  try {
+    let accumulatedSize = 0;
+    while (accumulatedSize <= maxSize) {
+      if (signal?.aborted) {
+        await reader.cancel(abortMsg);
+        throw signal.reason;
+      }
+      const { done, value } = await reader.read();
+      if (signal?.aborted) {
+        throw signal.reason;
+      }
+      if (done) {
+        break;
+      }
+      accumulatedSize += value.byteLength;
+      if (accumulatedSize > maxSize) {
+        await reader.cancel('Size limit exceeded');
+        throw new DOMException(
+          `Payload (${accumulatedSize} bytes) exceeds max (${maxSize} bytes).`,
+          'NotReadableError'
+        );
+      }
+      chunks.push(value);
+    }
+    const combined = new Uint8Array(accumulatedSize);
+    let offset = 0;
+    for (const chunk of chunks) {
+      combined.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    return combined.buffer;
+  } finally {
+    signal?.removeEventListener('abort', onAbort);
+    reader.releaseLock();
+  }
+};
+
+/**
+ * Fetches a Blob URL and extracts its ArrayBuffer and MIME type.
+ * @param {string} url - The Blob URL to fetch.
+ * @param {number} [maxBlobSize] - The maximum allowed Blob size in bytes.
+ * @param {AbortSignal} [signal] - The abort signal.
+ * @returns {Promise<{ buffer: ArrayBuffer, mimeType: string }>} A promise resolving to the buffer and MIME type.
+ */
+export const fetchBlobAsArrayBuffer = async (url, maxBlobSize, signal) => {
+  let maxSize = MAX_BLOB_SIZE;
+  if (Number.isInteger(maxBlobSize) && maxBlobSize > 0) {
+    maxSize = maxBlobSize;
+  }
+  const response = await fetch(url, { signal });
+  if (!response.ok) {
+    const truncatedURL = truncateURL(url);
+    let msg = `Failed to fetch ${truncatedURL}`;
+    if (Number.isInteger(response.status)) {
+      if (response.statusText) {
+        msg += `: ${response.status} ${response.statusText}`;
+      } else {
+        msg += `: ${response.status}`;
+      }
+    }
+    throw new Error(msg);
+  }
+  const contentLength = response.headers.get('content-length');
+  if (contentLength) {
+    const parsedLength = Number.parseInt(contentLength, DECI);
+    if (Number.isInteger(parsedLength) && parsedLength > maxSize) {
+      throw new DOMException(
+        `Payload (${parsedLength} bytes) exceeds max (${maxSize} bytes).`,
+        'NotReadableError'
+      );
+    }
+  }
+  const mimeType = response.headers.get('content-type') || '';
+  let buffer;
+  if (response.body) {
+    buffer = await readStreamInChunksAsArrayBuffer(response, maxSize, signal);
+  } else {
+    const blob = await response.blob();
+    if (blob.size > maxSize) {
+      throw new DOMException(
+        `Payload (${blob.size} bytes) exceeds max (${maxSize} bytes).`,
+        'NotReadableError'
+      );
+    }
+    buffer = await blob.arrayBuffer();
+  }
+  return { buffer, mimeType };
+};

package/types/index.d.ts

@@ -30,6 +30,7 @@ export type InspectedURLResult = {
     hash?: string;
 };
 export type SanitizeOptions = {
+    signal?: AbortSignal;
     allow?: string[];
     deny?: string[];
     only?: string[];

package/types/mjs/sanitize.d.ts

@@ -11,6 +11,7 @@ export declare class URLSanitizer extends URISchemes {
     private #isWellFormedScheme;
     private #normalizeOptions;
     private #inspect;
+    private #inspectBlob;
     get(): string[];
     has(scheme: string): boolean;
     add(scheme: string): string[];
@@ -18,6 +19,6 @@ export declare class URLSanitizer extends URISchemes {
     reset(): void;
     sanitizeURL(url: string, opt?: SanitizeOptions): Promise<string | null>;
     sanitizeURLSync(url: string, opt?: SanitizeOptions): string | null;
-    inspectURL(url: string): Promise<InspectedURLResult>;
+    inspectURL(url: string, opt?: SanitizeOptions): Promise<InspectedURLResult>;
     isValidURI(uri: string): boolean;
 }

package/types/mjs/utility.d.ts

@@ -16,3 +16,8 @@ export declare const parseURLEncodedNumCharRef: (str: string, nest?: number) =>
 export declare const extractDataURLComponents: (pathname: string, search?: string, hash?: string) => DataURLComponents;
 export declare const parseBase64: (data: string) => string;
 export declare const encodeBufferToBase64: (buffer: ArrayBuffer) => string;
+export declare const readStreamInChunksAsArrayBuffer: (response: Response, maxSize: number, signal?: AbortSignal) => Promise<ArrayBuffer>;
+export declare const fetchBlobAsArrayBuffer: (url: string, maxBlobSize?: number, signal?: AbortSignal) => Promise<{
+    buffer: ArrayBuffer;
+    mimeType: string;
+}>;