@locker/shared-url
Advanced tools
Comparing version 0.13.5 to 0.13.6
@@ -12,34 +12,30 @@ /** | ||
const DEFAULT_URL_SCHEMES = ['http:', 'https:']; | ||
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime']; | ||
const REMOVE_URL_CHARS_REGEXP = /[\u2029\u2028\n\r\t]/g; | ||
const normalizerAnchor = sharedDom.DocumentCreateElement(document, 'a'); | ||
const TRUSTED_DOMAINS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/; | ||
const { get: linkHrefGetter, set: linkHrefSetter } = shared.ReflectGetOwnPropertyDescriptor(HTMLAnchorElement.prototype, 'href'); | ||
const linkHostnameGetter = shared.ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'hostname'); | ||
const linkNormalizerToAbsoluteURL = sharedDom.DocumentCreateElement(document, 'a'); | ||
const linkPathnameGetter = shared.ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'pathname'); | ||
const linkProtocolGetter = shared.ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'protocol'); | ||
// TODO [W-7302311] Make paths and domains configurable | ||
function isInvalidURL(parsedURL) { | ||
const pathname = shared.StringToLowerCase(parsedURL.pathname); | ||
return shared.ArraySome(DISALLOWED_ENDPOINTS, (dep) => shared.StringIncludes(pathname, dep)); | ||
} | ||
function isValidURLScheme(url, schemes = DEFAULT_URL_SCHEMES) { | ||
shared.ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]); | ||
return shared.ArrayIncludes(schemes, shared.ReflectApply(linkProtocolGetter, linkNormalizerToAbsoluteURL, shared.emptyArray)); | ||
sharedDom.HTMLAnchorElementHrefSetter(normalizerAnchor, url); | ||
return shared.ArrayIncludes(schemes, sharedDom.HTMLAnchorElementProtocolGetter(normalizerAnchor)); | ||
} | ||
function sanitizeURLString(urlString) { | ||
return urlString === '' ? urlString : shared.StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, ''); | ||
} | ||
function sanitizeURLForElement(url) { | ||
shared.ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]); | ||
return sanitizeURLString(shared.ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, shared.emptyArray)); | ||
} | ||
function parseURL(url) { | ||
shared.ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [sanitizeURLString(url)]); | ||
sharedDom.HTMLAnchorElementHrefSetter(normalizerAnchor, sanitizeURLString(url)); | ||
return { | ||
normalizedURL: shared.ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, shared.emptyArray), | ||
hostname: shared.ReflectApply(linkHostnameGetter, linkNormalizerToAbsoluteURL, shared.emptyArray), | ||
pathname: decodeURIComponent(shared.ReflectApply(linkPathnameGetter, linkNormalizerToAbsoluteURL, shared.emptyArray)), | ||
normalizedURL: sharedDom.HTMLAnchorElementHrefGetter(normalizerAnchor), | ||
hostname: sharedDom.HTMLAnchorElementHostnameGetter(normalizerAnchor), | ||
pathname: sharedDom.WindowStaticDecodeURIComponent(sharedDom.HTMLAnchorElementPathnameGetter(normalizerAnchor)), | ||
}; | ||
} | ||
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime']; | ||
// TODO [W-7302311] Make paths and domains configurable | ||
function isInvalidURL(parsedURL) { | ||
const pathname = shared.StringToLowerCase(parsedURL.pathname); | ||
return shared.ArraySome(DISALLOWED_ENDPOINTS, (dep) => shared.StringIncludes(pathname, dep)); | ||
function sanitizeURLForElement(url) { | ||
sharedDom.HTMLAnchorElementHrefSetter(normalizerAnchor, url); | ||
return sanitizeURLString(sharedDom.HTMLAnchorElementHrefGetter(normalizerAnchor)); | ||
} | ||
function sanitizeURLString(urlString) { | ||
return urlString === '' ? urlString : shared.StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, ''); | ||
} | ||
@@ -52,2 +48,2 @@ exports.TRUSTED_DOMAINS = TRUSTED_DOMAINS; | ||
exports.sanitizeURLString = sanitizeURLString; | ||
/** version: 0.13.5 */ | ||
/** version: 0.13.6 */ |
/** | ||
* Copyright (C) 2019 salesforce.com, inc. | ||
*/ | ||
import { ReflectGetOwnPropertyDescriptor, ObjectLookupOwnGetter, ReflectApply, ArrayIncludes, emptyArray, StringReplace, StringToLowerCase, ArraySome, StringIncludes } from '@locker/shared'; | ||
import { DocumentCreateElement } from '@locker/shared-dom'; | ||
import { StringToLowerCase, ArraySome, StringIncludes, ArrayIncludes, StringReplace } from '@locker/shared'; | ||
import { DocumentCreateElement, HTMLAnchorElementHrefSetter, HTMLAnchorElementProtocolGetter, HTMLAnchorElementHrefGetter, HTMLAnchorElementHostnameGetter, WindowStaticDecodeURIComponent, HTMLAnchorElementPathnameGetter } from '@locker/shared-dom'; | ||
const DEFAULT_URL_SCHEMES = ['http:', 'https:']; | ||
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime']; | ||
const REMOVE_URL_CHARS_REGEXP = /[\u2029\u2028\n\r\t]/g; | ||
const normalizerAnchor = DocumentCreateElement(document, 'a'); | ||
const TRUSTED_DOMAINS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/; | ||
const { get: linkHrefGetter, set: linkHrefSetter } = ReflectGetOwnPropertyDescriptor(HTMLAnchorElement.prototype, 'href'); | ||
const linkHostnameGetter = ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'hostname'); | ||
const linkNormalizerToAbsoluteURL = DocumentCreateElement(document, 'a'); | ||
const linkPathnameGetter = ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'pathname'); | ||
const linkProtocolGetter = ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'protocol'); | ||
// TODO [W-7302311] Make paths and domains configurable | ||
function isInvalidURL(parsedURL) { | ||
const pathname = StringToLowerCase(parsedURL.pathname); | ||
return ArraySome(DISALLOWED_ENDPOINTS, (dep) => StringIncludes(pathname, dep)); | ||
} | ||
function isValidURLScheme(url, schemes = DEFAULT_URL_SCHEMES) { | ||
ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]); | ||
return ArrayIncludes(schemes, ReflectApply(linkProtocolGetter, linkNormalizerToAbsoluteURL, emptyArray)); | ||
HTMLAnchorElementHrefSetter(normalizerAnchor, url); | ||
return ArrayIncludes(schemes, HTMLAnchorElementProtocolGetter(normalizerAnchor)); | ||
} | ||
function sanitizeURLString(urlString) { | ||
return urlString === '' ? urlString : StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, ''); | ||
} | ||
function sanitizeURLForElement(url) { | ||
ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]); | ||
return sanitizeURLString(ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, emptyArray)); | ||
} | ||
function parseURL(url) { | ||
ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [sanitizeURLString(url)]); | ||
HTMLAnchorElementHrefSetter(normalizerAnchor, sanitizeURLString(url)); | ||
return { | ||
normalizedURL: ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, emptyArray), | ||
hostname: ReflectApply(linkHostnameGetter, linkNormalizerToAbsoluteURL, emptyArray), | ||
pathname: decodeURIComponent(ReflectApply(linkPathnameGetter, linkNormalizerToAbsoluteURL, emptyArray)), | ||
normalizedURL: HTMLAnchorElementHrefGetter(normalizerAnchor), | ||
hostname: HTMLAnchorElementHostnameGetter(normalizerAnchor), | ||
pathname: WindowStaticDecodeURIComponent(HTMLAnchorElementPathnameGetter(normalizerAnchor)), | ||
}; | ||
} | ||
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime']; | ||
// TODO [W-7302311] Make paths and domains configurable | ||
function isInvalidURL(parsedURL) { | ||
const pathname = StringToLowerCase(parsedURL.pathname); | ||
return ArraySome(DISALLOWED_ENDPOINTS, (dep) => StringIncludes(pathname, dep)); | ||
function sanitizeURLForElement(url) { | ||
HTMLAnchorElementHrefSetter(normalizerAnchor, url); | ||
return sanitizeURLString(HTMLAnchorElementHrefGetter(normalizerAnchor)); | ||
} | ||
function sanitizeURLString(urlString) { | ||
return urlString === '' ? urlString : StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, ''); | ||
} | ||
export { TRUSTED_DOMAINS, isInvalidURL, isValidURLScheme, parseURL, sanitizeURLForElement, sanitizeURLString }; | ||
/** version: 0.13.5 */ | ||
/** version: 0.13.6 */ |
{ | ||
"name": "@locker/shared-url", | ||
"version": "0.13.5", | ||
"version": "0.13.6", | ||
"license": "Salesforce Developer Agreement", | ||
@@ -13,6 +13,2 @@ "author": "Salesforce UI Security Team", | ||
}, | ||
"files": [ | ||
"dist/", | ||
"types/" | ||
], | ||
"scripts": { | ||
@@ -23,6 +19,10 @@ "build": "tsc --project tsconfig.types.json && rollup --config .rolluprc.cjs", | ||
"dependencies": { | ||
"@locker/shared": "0.13.5", | ||
"@locker/shared-dom": "0.13.5" | ||
"@locker/shared": "0.13.6", | ||
"@locker/shared-dom": "0.13.6" | ||
}, | ||
"gitHead": "213b7ea798dd4a01891a5b5ead2cff46f6db5600" | ||
"files": [ | ||
"dist/", | ||
"types/" | ||
], | ||
"gitHead": "c323e27d3a3d5767725b338c81f9e24cb59cbc6f" | ||
} |
@@ -0,13 +1,9 @@ | ||
import { ParsedURL } from './types'; | ||
export declare const TRUSTED_DOMAINS: RegExp; | ||
export declare function isInvalidURL(parsedURL: ParsedURL): boolean; | ||
export declare function isValidURLScheme(url: string, schemes?: string[]): boolean; | ||
export declare function parseURL(url: string): ParsedURL; | ||
export declare function sanitizeURLForElement(url: string): string; | ||
export declare function sanitizeURLString(urlString: string): string; | ||
export declare function sanitizeURLForElement(url: string): string; | ||
interface ParsedURL { | ||
readonly normalizedURL: string; | ||
readonly hostname: string; | ||
readonly pathname: string; | ||
} | ||
export declare function parseURL(url: string): ParsedURL; | ||
export declare function isInvalidURL(parsedURL: ParsedURL): boolean; | ||
export {}; | ||
export * from './types'; | ||
//# sourceMappingURL=index.d.ts.map |
Sorry, the diff of this file is not supported yet
8
8502
92
+ Added@locker/shared@0.13.6(transitive)
+ Added@locker/shared-dom@0.13.6(transitive)
- Removed@locker/shared@0.13.5(transitive)
- Removed@locker/shared-dom@0.13.5(transitive)
Updated@locker/shared@0.13.6
Updated@locker/shared-dom@0.13.6