File size: 1,601 Bytes
bc20498 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 |
"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.sanitizeUrl = exports.BLANK_URL = void 0;
var invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im;
var htmlEntitiesRegex = /&#(\w+)(^\w|;)?/g;
var htmlCtrlEntityRegex = /&(newline|tab);/gi;
var ctrlCharactersRegex = /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
var urlSchemeRegex = /^.+(:|:)/gim;
var relativeFirstCharacters = [".", "/"];
exports.BLANK_URL = "about:blank";
function isRelativeUrlWithoutProtocol(url) {
return relativeFirstCharacters.indexOf(url[0]) > -1;
}
// adapted from https://stackoverflow.com/a/29824550/2601552
function decodeHtmlCharacters(str) {
var removedNullByte = str.replace(ctrlCharactersRegex, "");
return removedNullByte.replace(htmlEntitiesRegex, function (match, dec) {
return String.fromCharCode(dec);
});
}
function sanitizeUrl(url) {
if (!url) {
return exports.BLANK_URL;
}
var sanitizedUrl = decodeHtmlCharacters(url)
.replace(htmlCtrlEntityRegex, "")
.replace(ctrlCharactersRegex, "")
.trim();
if (!sanitizedUrl) {
return exports.BLANK_URL;
}
if (isRelativeUrlWithoutProtocol(sanitizedUrl)) {
return sanitizedUrl;
}
var urlSchemeParseResults = sanitizedUrl.match(urlSchemeRegex);
if (!urlSchemeParseResults) {
return sanitizedUrl;
}
var urlScheme = urlSchemeParseResults[0];
if (invalidProtocolRegex.test(urlScheme)) {
return exports.BLANK_URL;
}
return sanitizedUrl;
}
exports.sanitizeUrl = sanitizeUrl;
|