url-sanitizer 5.3.2 → 5.3.3

package/package.json

@@ -80,5 +80,5 @@
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
-  "version": "5.3.2"
+  "version": "5.3.3"
 }

package/src/index.js

@@ -84,9 +84,11 @@ export const sanitizeURLSync = (url, opt) =>
  * Sanitizes the given URL and returns its parsed components.
  * NOTE: Blob URLs are not revoked after inspection.
  * @param {string} url - The URL string to inspect.
+ * @param {SanitizeOptions} [opt] - The sanitization options.
  * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
  */
-export const inspectURL = async url => sanitizer.inspectURL(url);
+export const inspectURL = async (url, opt = {}) =>
+  sanitizer.inspectURL(url, opt);
 
 /**
  * Checks if the given string is a valid URI and is registered.

package/src/mjs/sanitize.js

@@ -118,9 +118,10 @@ export class URLSanitizer extends URISchemes {
    * Inspects, parses, and sanitizes the given URL.
    * @private
    * @param {string} url - The URL string to parse.
+   * @param {InternalSanitizeOptions} options - Sanitization options.
    * @returns {InspectedURLResult} The result of an inspected URL.
    */
-  #inspect(url) {
+  #inspect(url, options) {
     const inspectedURL = {
       input: url,
       href: null,
@@ -137,12 +138,7 @@ export class URLSanitizer extends URISchemes {
     let sanitizedURL;
     let invalidReason = null;
     try {
-      sanitizedURL = this.#filter.sanitize(url, {
-        ...this.#defaultOpts,
-        allow: ['data'],
-        allowRelative: true,
-        schemes: this.#allowedSchemes
-      });
+      sanitizedURL = this.#filter.sanitize(url, options);
       if (!sanitizedURL) {
         invalidReason =
           'Sanitization failed (blocked by allowed schemes or rules).';
@@ -389,7 +385,7 @@ export class URLSanitizer extends URISchemes {
    * @param {SanitizeOptions} [opt] - The sanitization options.
    * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
    */
-  async inspectURL(url, opt) {
+  async inspectURL(url, opt = {}) {
     const { options, scheme } = this.#normalizeOptions(url, opt);
     if (scheme === 'blob') {
       return this.#inspectBlob(url, options);

package/types/index.d.ts

@@ -44,7 +44,7 @@ export { URLSanitizer };
 declare const sanitizer: URLSanitizer;
 export declare const sanitizeURL: (url: string, opt?: SanitizeOptions) => Promise<string | null>;
 export declare const sanitizeURLSync: (url: string, opt?: SanitizeOptions) => string | null;
-export declare const inspectURL: (url: string) => Promise<InspectedURLResult>;
+export declare const inspectURL: (url: string, opt?: SanitizeOptions) => Promise<InspectedURLResult>;
 export declare const isValidURI: (uri: string) => boolean;
 export declare const isURISync: (uri: string) => boolean;
 export default sanitizer;

package/types/mjs/filter.d.ts

@@ -12,6 +12,7 @@ export declare class SanitizeContext {
     schemeMap: Map<string, boolean>;
     allowRelative: boolean | undefined;
     debug: boolean | undefined;
+    schemes: Set<string> | undefined;
     constructor(domPurifyInstance: DOMPurify, opt?: InternalSanitizeOptions);
     private #compileRules;
     private #registerScheme;