@braintree/sanitize-url - npm Package Compare versions

Comparing version 2.0.1 to 2.0.2

CHANGELOG.md

 CHANGELOG
 =========
 
+## 2.0.2
+* Sanitize malicious URLs that begin with `\s`
+
 ## 2.0.1
@@ -5,0 +8,0 @@ * Sanitize malicious URLs that begin with %20

index.js

 'use strict';
 
-var invalidPrototcolRegex = /^(%20)*(javascript|data)/im;
+var invalidPrototcolRegex = /^(%20|\s)*(javascript|data)/im;
 var ctrlCharactersRegex = /[^\x20-\x7E]/gmi;
@@ -5,0 +5,0 @@ var urlSchemeRegex = /^([^:]+):/gm;

package.json

 {
   "name": "@braintree/sanitize-url",
-  "version": "2.0.1",
+  "version": "2.0.2",
   "description": "A url sanitizer",
@@ -5,0 +5,0 @@ "main": "index.js",

test/test.js

@@ -23,2 +23,6 @@ 'use strict';
 
+  it('replaces javascript urls with about:blank when javascript url begins with \s', function () {
+    expect(sanitizeUrl('    javascript:alert(document.domain)')).to.equal('about:blank');
+  });
+
   it('does not replace javascript: if it is not in the scheme of the URL', function () {
@@ -36,2 +40,6 @@ expect(sanitizeUrl('http://example.com#myjavascript:foo')).to.equal('http://example.com#myjavascript:foo');
 
+  it('replaces data urls with about:blank when data url begins with \s', function () {
+    expect(sanitizeUrl('    data:text/html;basfe64,PH%3Cscript%3Ealert(document.domain)%3C/script%3E')).to.equal('about:blank');
+  });
+
   it('disregards capitalization for data urls', function () {
@@ -38,0 +46,0 @@ expect(sanitizeUrl('dAtA:text/html;basfe64,PH%3Cscript%3Ealert(document.domain)%3C/script%3E')).to.equal('about:blank');

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

6935

increased by7.42%

Lines of code

73

increased by8.96%

No dependency changes