Latest Threat Research:SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains.Details →
Socket
Book a DemoSign in
Socket
Book a DemoSign in

data-urls

Package Overview
Dependencies
Maintainers
6
Versions
12
Alerts
File Explorer

Advanced tools

License
Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

data-urls - npm Package Compare versions

Comparing version
6.0.0
 to
6.0.1
+1
-1
lib/parser.js
"use strict";
const MIMEType = require("whatwg-mimetype");
const { MIMEType } = require("whatwg-mimetype");
const { parseURL, serializeURL, percentDecodeString } = require("whatwg-url");

@@ -4,0 +4,0 @@ const { stripLeadingAndTrailingASCIIWhitespace, isomorphicDecode, forgivingBase64Decode } = require("./utils.js");

+7
-8
package.json

@@ -12,3 +12,3 @@ {

],
"version": "6.0.0",
"version": "6.0.1",
"author": "Domenic Denicola <d@domenic.me> (https://domenic.me/)",

@@ -27,8 +27,8 @@ "license": "MIT",

"coverage": "c8 node --test --experimental-test-coverage",
"lint": "eslint .",
"pretest": "node scripts/get-latest-platform-tests.js"
"lint": "eslint",
"pretest": "node scripts/get-latest-platform-tests.mjs"
},
"dependencies": {
"whatwg-mimetype": "^4.0.0",
"whatwg-url": "^15.0.0"
"whatwg-mimetype": "^5.0.0",
"whatwg-url": "^15.1.0"
},

@@ -38,4 +38,4 @@ "devDependencies": {

"c8": "^10.1.3",
"eslint": "^9.35.0",
"globals": "^16.4.0"
"eslint": "^9.39.2",
"globals": "^17.0.0"
},

@@ -47,3 +47,2 @@ "engines": {

"reporter": [
"text",
"html"

@@ -50,0 +49,0 @@ ],

+11
-7
README.md

@@ -35,20 +35,24 @@ # Parse `data:` URLs

To decode the body bytes of a parsed data URL, you'll need to use the `charset` parameter of the MIME type, if any. This contains an encoding [label](https://encoding.spec.whatwg.org/#label); there are [various possible labels](https://encoding.spec.whatwg.org/#names-and-labels) for a given encoding. We suggest using the [whatwg-encoding](https://www.npmjs.com/package/whatwg-encoding) package as follows:
To decode the body bytes of a parsed data URL, you'll need to use the `charset` parameter of the MIME type, if any. This contains an encoding [label](https://encoding.spec.whatwg.org/#label); there are [various possible labels](https://encoding.spec.whatwg.org/#names-and-labels) for a given encoding. You can use the [`TextDecoder`](https://developer.mozilla.org/en-US/docs/Web/API/TextDecoder) API for this:
```js
const parseDataURL = require("data-urls");
const { labelToName, decode } = require("whatwg-encoding");
const dataURL = parseDataURL(arbitraryString);
// If there's no charset parameter, let's just hope it's UTF-8; that seems like a good guess.
const encodingName = labelToName(dataURL.mimeType.parameters.get("charset") || "utf-8");
const bodyDecoded = decode(dataURL.body, encodingName);
// If there's no charset parameter, e.g. if `arbitraryString` is `"data:text/plain,H%C3%A9llo!"`,
// then let's guess UTF-8.
const encodingLabel = dataURL.mimeType.parameters.get("charset") ?? "utf-8";
const decoder = new TextDecoder(encodingLabel);
const bodyDecoded = decoder.decode(dataURL.body);
```
This is especially important since the default, if no parseable MIME type is given, is "US-ASCII", [aka windows-1252](https://encoding.spec.whatwg.org/#names-and-labels), not UTF-8 like you might asume. So for example given an `arbitraryString` of `"data:,Héllo!"`, the above code snippet will correctly produce a `bodyDecoded` of `"Héllo!"` by using the windows-1252 decoder, whereas if you used a UTF-8 decoder you'd get back `"Héllo!"`.
(Note that as of the time of this writing in 2026-01, Node.js's built-in `TextDecoder` has many correctness bugs, so we suggest using the polyfill from the [`@exodus/bytes`](https://www.npmjs.com/package/@exodus/bytes) package until they are fixed.)
Using the parsed charset is quite important, since [the spec requires](https://fetch.spec.whatwg.org/#data-url-processor) that if no parseable MIME type is given, the default is `"US-ASCII"`, [aka windows-1252](https://encoding.spec.whatwg.org/#note-latin1-ascii)—not UTF-8, like you might asume. So for example, given an `arbitraryString` of `"data:,H%E9llo!"`, the above code snippet will correctly produce a `bodyDecoded` of `"Héllo!"` by using the windows-1252 decoder, whereas if you used a UTF-8 decoder you'd get back `"H�llo!"`.
### Advanced functionality: parsing from a URL record
If you are using the [whatwg-url](https://github.com/jsdom/whatwg-url) package, you may already have a "URL record" object on hand, as produced by that package's `parseURL` export. In that case, you can use this package's `fromURLRecord` export to save a bit of work:
If you are using the [`whatwg-url`](https://www.npmjs.com/package/whatwg-url) package, you may already have a "URL record" object on hand, as produced by that package's `parseURL` export. In that case, you can use this package's `fromURLRecord` export to save a bit of work:

@@ -55,0 +59,0 @@ ```js