New Case Study:See how Anthropic automated 95% of dependency reviews with Socket.Learn More
Socket
Sign inDemoInstall
Socket

@locker/shared-url

Package Overview
Dependencies
Maintainers
7
Versions
236
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@locker/shared-url - npm Package Compare versions

Comparing version 0.13.5 to 0.13.6

types/types.d.ts

44

dist/index.cjs.js

@@ -12,34 +12,30 @@ /**

const DEFAULT_URL_SCHEMES = ['http:', 'https:'];
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime'];
const REMOVE_URL_CHARS_REGEXP = /[\u2029\u2028\n\r\t]/g;
const normalizerAnchor = sharedDom.DocumentCreateElement(document, 'a');
const TRUSTED_DOMAINS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/;
const { get: linkHrefGetter, set: linkHrefSetter } = shared.ReflectGetOwnPropertyDescriptor(HTMLAnchorElement.prototype, 'href');
const linkHostnameGetter = shared.ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'hostname');
const linkNormalizerToAbsoluteURL = sharedDom.DocumentCreateElement(document, 'a');
const linkPathnameGetter = shared.ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'pathname');
const linkProtocolGetter = shared.ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'protocol');
// TODO [W-7302311] Make paths and domains configurable
function isInvalidURL(parsedURL) {
const pathname = shared.StringToLowerCase(parsedURL.pathname);
return shared.ArraySome(DISALLOWED_ENDPOINTS, (dep) => shared.StringIncludes(pathname, dep));
}
function isValidURLScheme(url, schemes = DEFAULT_URL_SCHEMES) {
shared.ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]);
return shared.ArrayIncludes(schemes, shared.ReflectApply(linkProtocolGetter, linkNormalizerToAbsoluteURL, shared.emptyArray));
sharedDom.HTMLAnchorElementHrefSetter(normalizerAnchor, url);
return shared.ArrayIncludes(schemes, sharedDom.HTMLAnchorElementProtocolGetter(normalizerAnchor));
}
function sanitizeURLString(urlString) {
return urlString === '' ? urlString : shared.StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, '');
}
function sanitizeURLForElement(url) {
shared.ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]);
return sanitizeURLString(shared.ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, shared.emptyArray));
}
function parseURL(url) {
shared.ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [sanitizeURLString(url)]);
sharedDom.HTMLAnchorElementHrefSetter(normalizerAnchor, sanitizeURLString(url));
return {
normalizedURL: shared.ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, shared.emptyArray),
hostname: shared.ReflectApply(linkHostnameGetter, linkNormalizerToAbsoluteURL, shared.emptyArray),
pathname: decodeURIComponent(shared.ReflectApply(linkPathnameGetter, linkNormalizerToAbsoluteURL, shared.emptyArray)),
normalizedURL: sharedDom.HTMLAnchorElementHrefGetter(normalizerAnchor),
hostname: sharedDom.HTMLAnchorElementHostnameGetter(normalizerAnchor),
pathname: sharedDom.WindowStaticDecodeURIComponent(sharedDom.HTMLAnchorElementPathnameGetter(normalizerAnchor)),
};
}
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime'];
// TODO [W-7302311] Make paths and domains configurable
function isInvalidURL(parsedURL) {
const pathname = shared.StringToLowerCase(parsedURL.pathname);
return shared.ArraySome(DISALLOWED_ENDPOINTS, (dep) => shared.StringIncludes(pathname, dep));
function sanitizeURLForElement(url) {
sharedDom.HTMLAnchorElementHrefSetter(normalizerAnchor, url);
return sanitizeURLString(sharedDom.HTMLAnchorElementHrefGetter(normalizerAnchor));
}
function sanitizeURLString(urlString) {
return urlString === '' ? urlString : shared.StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, '');
}

@@ -52,2 +48,2 @@ exports.TRUSTED_DOMAINS = TRUSTED_DOMAINS;

exports.sanitizeURLString = sanitizeURLString;
/** version: 0.13.5 */
/** version: 0.13.6 */
/**
* Copyright (C) 2019 salesforce.com, inc.
*/
import { ReflectGetOwnPropertyDescriptor, ObjectLookupOwnGetter, ReflectApply, ArrayIncludes, emptyArray, StringReplace, StringToLowerCase, ArraySome, StringIncludes } from '@locker/shared';
import { DocumentCreateElement } from '@locker/shared-dom';
import { StringToLowerCase, ArraySome, StringIncludes, ArrayIncludes, StringReplace } from '@locker/shared';
import { DocumentCreateElement, HTMLAnchorElementHrefSetter, HTMLAnchorElementProtocolGetter, HTMLAnchorElementHrefGetter, HTMLAnchorElementHostnameGetter, WindowStaticDecodeURIComponent, HTMLAnchorElementPathnameGetter } from '@locker/shared-dom';
const DEFAULT_URL_SCHEMES = ['http:', 'https:'];
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime'];
const REMOVE_URL_CHARS_REGEXP = /[\u2029\u2028\n\r\t]/g;
const normalizerAnchor = DocumentCreateElement(document, 'a');
const TRUSTED_DOMAINS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/;
const { get: linkHrefGetter, set: linkHrefSetter } = ReflectGetOwnPropertyDescriptor(HTMLAnchorElement.prototype, 'href');
const linkHostnameGetter = ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'hostname');
const linkNormalizerToAbsoluteURL = DocumentCreateElement(document, 'a');
const linkPathnameGetter = ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'pathname');
const linkProtocolGetter = ObjectLookupOwnGetter(HTMLAnchorElement.prototype, 'protocol');
// TODO [W-7302311] Make paths and domains configurable
function isInvalidURL(parsedURL) {
const pathname = StringToLowerCase(parsedURL.pathname);
return ArraySome(DISALLOWED_ENDPOINTS, (dep) => StringIncludes(pathname, dep));
}
function isValidURLScheme(url, schemes = DEFAULT_URL_SCHEMES) {
ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]);
return ArrayIncludes(schemes, ReflectApply(linkProtocolGetter, linkNormalizerToAbsoluteURL, emptyArray));
HTMLAnchorElementHrefSetter(normalizerAnchor, url);
return ArrayIncludes(schemes, HTMLAnchorElementProtocolGetter(normalizerAnchor));
}
function sanitizeURLString(urlString) {
return urlString === '' ? urlString : StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, '');
}
function sanitizeURLForElement(url) {
ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [url]);
return sanitizeURLString(ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, emptyArray));
}
function parseURL(url) {
ReflectApply(linkHrefSetter, linkNormalizerToAbsoluteURL, [sanitizeURLString(url)]);
HTMLAnchorElementHrefSetter(normalizerAnchor, sanitizeURLString(url));
return {
normalizedURL: ReflectApply(linkHrefGetter, linkNormalizerToAbsoluteURL, emptyArray),
hostname: ReflectApply(linkHostnameGetter, linkNormalizerToAbsoluteURL, emptyArray),
pathname: decodeURIComponent(ReflectApply(linkPathnameGetter, linkNormalizerToAbsoluteURL, emptyArray)),
normalizedURL: HTMLAnchorElementHrefGetter(normalizerAnchor),
hostname: HTMLAnchorElementHostnameGetter(normalizerAnchor),
pathname: WindowStaticDecodeURIComponent(HTMLAnchorElementPathnameGetter(normalizerAnchor)),
};
}
const DISALLOWED_ENDPOINTS = ['/aura', '/webruntime'];
// TODO [W-7302311] Make paths and domains configurable
function isInvalidURL(parsedURL) {
const pathname = StringToLowerCase(parsedURL.pathname);
return ArraySome(DISALLOWED_ENDPOINTS, (dep) => StringIncludes(pathname, dep));
function sanitizeURLForElement(url) {
HTMLAnchorElementHrefSetter(normalizerAnchor, url);
return sanitizeURLString(HTMLAnchorElementHrefGetter(normalizerAnchor));
}
function sanitizeURLString(urlString) {
return urlString === '' ? urlString : StringReplace(urlString, REMOVE_URL_CHARS_REGEXP, '');
}
export { TRUSTED_DOMAINS, isInvalidURL, isValidURLScheme, parseURL, sanitizeURLForElement, sanitizeURLString };
/** version: 0.13.5 */
/** version: 0.13.6 */
{
"name": "@locker/shared-url",
"version": "0.13.5",
"version": "0.13.6",
"license": "Salesforce Developer Agreement",

@@ -13,6 +13,2 @@ "author": "Salesforce UI Security Team",

},
"files": [
"dist/",
"types/"
],
"scripts": {

@@ -23,6 +19,10 @@ "build": "tsc --project tsconfig.types.json && rollup --config .rolluprc.cjs",

"dependencies": {
"@locker/shared": "0.13.5",
"@locker/shared-dom": "0.13.5"
"@locker/shared": "0.13.6",
"@locker/shared-dom": "0.13.6"
},
"gitHead": "213b7ea798dd4a01891a5b5ead2cff46f6db5600"
"files": [
"dist/",
"types/"
],
"gitHead": "c323e27d3a3d5767725b338c81f9e24cb59cbc6f"
}

@@ -0,13 +1,9 @@

import { ParsedURL } from './types';
export declare const TRUSTED_DOMAINS: RegExp;
export declare function isInvalidURL(parsedURL: ParsedURL): boolean;
export declare function isValidURLScheme(url: string, schemes?: string[]): boolean;
export declare function parseURL(url: string): ParsedURL;
export declare function sanitizeURLForElement(url: string): string;
export declare function sanitizeURLString(urlString: string): string;
export declare function sanitizeURLForElement(url: string): string;
interface ParsedURL {
readonly normalizedURL: string;
readonly hostname: string;
readonly pathname: string;
}
export declare function parseURL(url: string): ParsedURL;
export declare function isInvalidURL(parsedURL: ParsedURL): boolean;
export {};
export * from './types';
//# sourceMappingURL=index.d.ts.map

Sorry, the diff of this file is not supported yet

SocketSocket SOC 2 Logo

Product

  • Package Alerts
  • Integrations
  • Docs
  • Pricing
  • FAQ
  • Roadmap
  • Changelog

Packages

npm

Stay in touch

Get open source security insights delivered straight into your inbox.


  • Terms
  • Privacy
  • Security

Made with ⚡️ by Socket Inc