File size: 3,168 Bytes
bc20498 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 |
import {asciiAlphanumeric} from 'micromark-util-character'
import {encode} from 'micromark-util-encode'
/**
* Make a value safe for injection as a URL.
*
* This encodes unsafe characters with percent-encoding and skips already
* encoded sequences (see `normalizeUri`).
* Further unsafe characters are encoded as character references (see
* `micromark-util-encode`).
*
* A regex of allowed protocols can be given, in which case the URL is
* sanitized.
* For example, `/^(https?|ircs?|mailto|xmpp)$/i` can be used for `a[href]`, or
* `/^https?$/i` for `img[src]` (this is what `github.com` allows).
* If the URL includes an unknown protocol (one not matched by `protocol`, such
* as a dangerous example, `javascript:`), the value is ignored.
*
* @param {string | undefined} url
* URI to sanitize.
* @param {RegExp | null | undefined} [protocol]
* Allowed protocols.
* @returns {string}
* Sanitized URI.
*/
export function sanitizeUri(url, protocol) {
const value = encode(normalizeUri(url || ''))
if (!protocol) {
return value
}
const colon = value.indexOf(':')
const questionMark = value.indexOf('?')
const numberSign = value.indexOf('#')
const slash = value.indexOf('/')
if (
// If there is no protocol, it’s relative.
colon < 0 ||
// If the first colon is after a `?`, `#`, or `/`, it’s not a protocol.
(slash > -1 && colon > slash) ||
(questionMark > -1 && colon > questionMark) ||
(numberSign > -1 && colon > numberSign) ||
// It is a protocol, it should be allowed.
protocol.test(value.slice(0, colon))
) {
return value
}
return ''
}
/**
* Normalize a URL.
*
* Encode unsafe characters with percent-encoding, skipping already encoded
* sequences.
*
* @param {string} value
* URI to normalize.
* @returns {string}
* Normalized URI.
*/
export function normalizeUri(value) {
/** @type {Array<string>} */
const result = []
let index = -1
let start = 0
let skip = 0
while (++index < value.length) {
const code = value.charCodeAt(index)
/** @type {string} */
let replace = ''
// A correct percent encoded value.
if (
code === 37 &&
asciiAlphanumeric(value.charCodeAt(index + 1)) &&
asciiAlphanumeric(value.charCodeAt(index + 2))
) {
skip = 2
}
// ASCII.
else if (code < 128) {
if (!/[!#$&-;=?-Z_a-z~]/.test(String.fromCharCode(code))) {
replace = String.fromCharCode(code)
}
}
// Astral.
else if (code > 55295 && code < 57344) {
const next = value.charCodeAt(index + 1)
// A correct surrogate pair.
if (code < 56320 && next > 56319 && next < 57344) {
replace = String.fromCharCode(code, next)
skip = 1
}
// Lone surrogate.
else {
replace = '\uFFFD'
}
}
// Unicode.
else {
replace = String.fromCharCode(code)
}
if (replace) {
result.push(value.slice(start, index), encodeURIComponent(replace))
start = index + skip + 1
replace = ''
}
if (skip) {
index += skip
skip = 0
}
}
return result.join('') + value.slice(start)
}
|