url-sanitizer 5.3.2 → 5.3.4

package/package.json

@@ -26,31 +26,32 @@
   },
   "dependencies": {
     "dompurify": "^3.4.16",
-    "jsdom": "^30.1.1"
+    "jsdom": "^30.1.2"
   },
   "devDependencies": {
     "@braintree/sanitize-url": "^7.1.2",
     "@types/jsdom": "^30.0.0",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.5",
     "c8": "^12.0.0",
-    "chai": "^6.2.2",
+    "chai": "^6.3.0",
     "commander": "^15.0.0",
-    "copyfiles-ng": "^2.4.7",
+    "copyfiles-ng": "^2.4.9",
     "esbuild": "^0.28.2",
-    "eslint": "^10.11.0",
+    "eslint": "^10.12.0",
     "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-jsdoc": "^64.5.4",
+    "eslint-plugin-jsdoc": "^65.2.2",
     "eslint-plugin-prettier": "^5.5.6",
     "eslint-plugin-regexp": "^3.3.1",
-    "eslint-plugin-unicorn": "^76.0.0",
+    "eslint-plugin-unicorn": "^77.0.0",
     "fast-check": "^4.10.2",
-    "globals": "^17.12.0",
+    "globals": "^17.13.0",
     "http-server": "^14.1.1",
     "mitata": "^1.0.34",
-    "mocha": "^12.0.2",
-    "neostandard": "^0.14.0-next.1",
+    "mocha": "^12.0.3",
+    "neostandard": "^0.14.0",
     "papaparse": "^5.7.0",
     "prettier": "^3.9.9",
+    "prettier-plugin-brace-style": "^0.10.3",
     "sinon": "^22.1.0",
     "strict-url-sanitise": "^0.0.1",
     "typescript": "^7.0.2",
@@ -80,5 +81,5 @@
   "engines": {
     "node": "^22.22.2 || ^24.15.0 || >=26.0.0"
   },
-  "version": "5.3.2"
+  "version": "5.3.4"
 }

package/src/index.js

@@ -84,9 +84,11 @@ export const sanitizeURLSync = (url, opt) =>
  * Sanitizes the given URL and returns its parsed components.
  * NOTE: Blob URLs are not revoked after inspection.
  * @param {string} url - The URL string to inspect.
+ * @param {SanitizeOptions} [opt] - The sanitization options.
  * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
  */
-export const inspectURL = async url => sanitizer.inspectURL(url);
+export const inspectURL = async (url, opt = {}) =>
+  sanitizer.inspectURL(url, opt);
 
 /**
  * Checks if the given string is a valid URI and is registered.

package/src/lib/iana/uri-schemes.json

@@ -1 +1 @@
-["aaa","aaas","about","acap","acct","acd","ace","acr","adiumxtra","adt","aet","afp","afs","agtp","aim","amss","android","appdata","apt","ar","ari","ark","ars","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","cap","cast","casts","chrome","chrome-extension","cid","cm","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","gcx","gdsi","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","interaction","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","pkg","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","rttp","sarif","secondlife","secret-token","seki","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tii","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]
+["aaa","aaas","about","acap","acct","acd","ace","acr","adiumxtra","adt","aet","afp","afs","agtp","aim","alter","amss","android","appdata","apt","ar","ari","ark","ars","arv","at","attachment","aw","barion","beshare","bitcoin","bitcoincash","bl","blob","bluetooth","bolo","brid","browserext","cabal","caip","calculator","callto","canactid","cap","cast","casts","chrome","chrome-extension","cid","cm","coap","coaps","com-eventbrite-attendee","content","content-type","crid","cstr","cttps","cvs","dab","dat","data","dav","dhttp","diaspora","dict","did","dilithium3","dis","dlna-playcontainer","dlna-playsingle","dnp","dns","dntp","doi","donau","dpp","drm","dtmi","dtn","dvb","dvx","dweb","ed2k","eid","elsi","embedded","ens","esim","ethereum","example","ez","facetime","feed","feedready","fido","file","finger","first-run-pen-experience","fish","fm","ftp","fuchsia-pkg","gcx","gdsi","geo","gg","git","gitoid","gizmoproject","go","gopher","graph","gsos","gtalk","h323","ham","hcap","hcp","hs20","http","https","hxxp","hxxps","hydrazone","hyper","i0","iax","ibi","ibi-","icap","icon","ilstring","im","imap","info","interaction","iotdisco","ipfs","ipn","ipns","ipp","ipps","irc","irc6","ircs","iris","iris.beep","iris.lwz","iris.xpc","iris.xpcs","isostore","itms","jabber","jar","jms","keyparc","lastfm","lbry","ldap","ldaps","leaptofrogans","lid","linkid","locus","lorawan","lpa","lvlt","machineProvisioningProgressReporter","magnet","mailto","maps","market","matrix","mdoc","mdoc-openid4vp","message","microsoft.windows.camera","microsoft.windows.camera.multipicker","microsoft.windows.camera.picker","mid","mms","mongodb","moz","moz-extension","mqtt","mqtts","ms-access","ms-appinstaller","ms-browser-extension","ms-calculator","ms-drive-to","ms-enrollment","ms-excel","ms-eyecontrolspeech","ms-gamebarservices","ms-gamingoverlay","ms-getoffice","ms-help","ms-infopath","ms-inputapp","ms-launchremotedesktop","ms-lockscreencomponent-config","ms-media-stream-id","ms-meetnow","ms-mixedrealitycapture","ms-mobileplans","ms-newsandinterests","ms-officeapp","ms-people","ms-personacard","ms-powerpoint","ms-project","ms-publisher","ms-recall","ms-remotedesktop","ms-remotedesktop-launch","ms-restoretabcompanion","ms-screenclip","ms-screensketch","ms-search","ms-search-repair","ms-secondary-screen-controller","ms-secondary-screen-setup","ms-settings","ms-settings-airplanemode","ms-settings-bluetooth","ms-settings-camera","ms-settings-cellular","ms-settings-cloudstorage","ms-settings-connectabledevices","ms-settings-displays-topology","ms-settings-emailandaccounts","ms-settings-language","ms-settings-location","ms-settings-lock","ms-settings-nfctransactions","ms-settings-notifications","ms-settings-power","ms-settings-privacy","ms-settings-proximity","ms-settings-screenrotation","ms-settings-wifi","ms-settings-workplace","ms-spd","ms-stickers","ms-sttoverlay","ms-transit-to","ms-useractivityset","ms-uup","ms-virtualtouchpad","ms-visio","ms-walk-to","ms-whiteboard","ms-whiteboard-cmd","ms-widgetboard","ms-widgets","ms-word","msnim","msrp","msrps","mss","mt","mtqp","mtrust","mumble","mupdate","musik","mvn","mvrp","mvrps","news","nfs","ni","nih","nntp","nostr","notes","npamp","num","ocf","oid","onenote","onenote-cmd","opaquelocktoken","openid","openpgp4fpr","otpauth","palm","paparazzi","payto","pkcs11","pkg","platform","pop","pres","proxy","psyc","pttp","pwid","qb","query","quic-transport","redis","rediss","reload","res","resource","rmi","rsync","rtmfp","rtmp","rtsp","rtsps","rtspu","rttp","sarif","secondlife","secret-token","seki","service","session","sftp","sgn","shc","shelter","sieve","simpleledger","simplex","sip","sips","skype","smb","smp","sms","smtp","snmp","soap.beep","soap.beeps","soldat","spacify","spiffe","spotify","ssb","ssh","sss","starknet","steam","stun","stuns","submit","svn","swh","swid","swidpath","tag","taler","tcxp","teamspeak","teapot","teapots","tel","teliaeid","telnet","tftp","things","thismessage","tii","tip","tn3270","tool","tttps","turn","turns","tv","udp","unreal","upn","urn","ust","ut2004","uuaid","uuid-in-package","v-event","vemmi","ventrilo","ves","view-source","vnc","vscode","vscode-insiders","vsls","w3","wasm","wasm-js","wcr","web3","webcal","wifi","ws","wss","wtai","wyciwyg","xcompute","xcon","xcon-userid","xfire","xftp","xmlrpc.beep","xmlrpc.beeps","xmpp","xrcp","xri","ymsgr","z39.50r","z39.50s","ztdnaid"]

package/src/mjs/sanitize.js

@@ -118,9 +118,10 @@ export class URLSanitizer extends URISchemes {
    * Inspects, parses, and sanitizes the given URL.
    * @private
    * @param {string} url - The URL string to parse.
+   * @param {InternalSanitizeOptions} options - Sanitization options.
    * @returns {InspectedURLResult} The result of an inspected URL.
    */
-  #inspect(url) {
+  #inspect(url, options) {
     const inspectedURL = {
       input: url,
       href: null,
@@ -137,12 +138,7 @@ export class URLSanitizer extends URISchemes {
     let sanitizedURL;
     let invalidReason = null;
     try {
-      sanitizedURL = this.#filter.sanitize(url, {
-        ...this.#defaultOpts,
-        allow: ['data'],
-        allowRelative: true,
-        schemes: this.#allowedSchemes
-      });
+      sanitizedURL = this.#filter.sanitize(url, options);
       if (!sanitizedURL) {
         invalidReason =
           'Sanitization failed (blocked by allowed schemes or rules).';
@@ -227,6 +223,23 @@ export class URLSanitizer extends URISchemes {
     }
   }
 
+  /**
+   * Re-throws errors or operation aborts.
+   * @private
+   * @param {Error} e - The error object to evaluate.
+   * @param {InternalSanitizeOptions} options - The internal sanitization options.
+   * @throws {Error} Re-throws the given error if it is a TypeError, AbortError, or aborted signal.
+   */
+  #shouldThrow(e, options) {
+    if (
+      e instanceof TypeError ||
+      e.name === 'AbortError' ||
+      options.signal?.aborted
+    ) {
+      throw e;
+    }
+  }
+
   /**
    * Gets the list of registered URI schemes.
    * @returns {string[]} An array of registered schemes.
@@ -349,16 +362,31 @@ export class URLSanitizer extends URISchemes {
             );
           }
         }
+      } catch (e) {
+        this.#shouldThrow(e, options);
+        if (options.debug) {
+          logDebug(`Failed to sanitize URL: ${truncateURL(url)}`, e);
+        }
+        return null;
       } finally {
         if (options.revokeObjectURL) {
           URL.revokeObjectURL(url);
         }
       }
       return sanitizedData;
-    } else if (scheme === 'data') {
-      return this.#filter.sanitizeDataURL(url, options);
     }
-    return this.#filter.sanitize(url, options);
+    try {
+      if (scheme === 'data') {
+        return this.#filter.sanitizeDataURL(url, options);
+      }
+      return this.#filter.sanitize(url, options);
+    } catch (e) {
+      this.#shouldThrow(e, options);
+      if (options.debug) {
+        logDebug(`Failed to sanitize URL: ${truncateURL(url)}`, e);
+      }
+      return null;
+    }
   }
 
   /**
@@ -380,7 +408,15 @@ export class URLSanitizer extends URISchemes {
       }
       return null;
     }
-    return this.#filter.sanitize(url, options);
+    try {
+      return this.#filter.sanitize(url, options);
+    } catch (e) {
+      this.#shouldThrow(e, options);
+      if (options.debug) {
+        logDebug(`Failed to sanitize URL: ${truncateURL(url)}`, e);
+      }
+      return null;
+    }
   }
 
   /**
@@ -389,7 +425,7 @@ export class URLSanitizer extends URISchemes {
    * @param {SanitizeOptions} [opt] - The sanitization options.
    * @returns {Promise<InspectedURLResult>} A promise resolving to the inspected URL result.
    */
-  async inspectURL(url, opt) {
+  async inspectURL(url, opt = {}) {
     const { options, scheme } = this.#normalizeOptions(url, opt);
     if (scheme === 'blob') {
       return this.#inspectBlob(url, options);

package/src/mjs/utility.js

@@ -356,6 +356,8 @@ export const encodeBufferToBase64 = buffer => {
  * @param {AbortSignal} [signal] - The abort signal.
  * @returns {Promise<ArrayBuffer>} A promise resolving to the generated ArrayBuffer.
  */
+// Stream reading requires sequential async execution.
+/* eslint-disable no-await-in-loop */
 export const readStreamInChunksAsArrayBuffer = async (
   response,
   maxSize,
@@ -409,6 +411,7 @@ export const readStreamInChunksAsArrayBuffer = async (
     reader.releaseLock();
   }
 };
+/* eslint-enable no-await-in-loop */
 
 /**
  * Fetches a Blob URL and extracts its ArrayBuffer and MIME type.

package/types/index.d.ts

@@ -44,7 +44,7 @@ export { URLSanitizer };
 declare const sanitizer: URLSanitizer;
 export declare const sanitizeURL: (url: string, opt?: SanitizeOptions) => Promise<string | null>;
 export declare const sanitizeURLSync: (url: string, opt?: SanitizeOptions) => string | null;
-export declare const inspectURL: (url: string) => Promise<InspectedURLResult>;
+export declare const inspectURL: (url: string, opt?: SanitizeOptions) => Promise<InspectedURLResult>;
 export declare const isValidURI: (uri: string) => boolean;
 export declare const isURISync: (uri: string) => boolean;
 export default sanitizer;

package/types/mjs/filter.d.ts

@@ -12,6 +12,7 @@ export declare class SanitizeContext {
     schemeMap: Map<string, boolean>;
     allowRelative: boolean | undefined;
     debug: boolean | undefined;
+    schemes: Set<string> | undefined;
     constructor(domPurifyInstance: DOMPurify, opt?: InternalSanitizeOptions);
     private #compileRules;
     private #registerScheme;

package/types/mjs/sanitize.d.ts

@@ -12,6 +12,7 @@ export declare class URLSanitizer extends URISchemes {
     private #normalizeOptions;
     private #inspect;
     private #inspectBlob;
+    private #shouldThrow;
     get(): string[];
     has(scheme: string): boolean;
     add(scheme: string): string[];