micromark-util-sanitize-uri

What is micromark-util-sanitize-uri?

The micromark-util-sanitize-uri npm package is designed to sanitize URLs within markdown content. It ensures that the URLs are safe to use by escaping or removing potentially harmful elements. This is particularly useful in preventing XSS (Cross-Site Scripting) attacks and other vulnerabilities that can arise from malicious URLs.

What are micromark-util-sanitize-uri's main functionalities?

Sanitize URLs

This feature allows you to sanitize URLs to ensure they are safe to use. It converts potentially dangerous URLs (like those starting with 'javascript:') into harmless ones (e.g., 'about:blank'), while leaving safe URLs unchanged.

"use strict";
var sanitize = require('micromark-util-sanitize-uri');

var safeUrl = sanitize('javascript:alert(document.cookie)');
console.log(safeUrl); // Logs: 'about:blank'

var safeUrl2 = sanitize('https://example.com');
console.log(safeUrl2); // Logs: 'https://example.com'

Other packages similar to micromark-util-sanitize-uri

sanitize-url

Like micromark-util-sanitize-uri, sanitize-url is designed to make URLs safe to use by sanitizing them. It removes or escapes parts of the URL that could be used for XSS attacks. The main difference is in the specific implementation and API design, where sanitize-url might offer different or additional options for sanitization.

dompurify

DOMPurify is a more general-purpose library for sanitizing HTML and preventing XSS attacks. While it can be used to sanitize URLs within HTML content, it is broader in scope compared to micromark-util-sanitize-uri, which focuses specifically on URLs within markdown. DOMPurify provides a wide range of options for sanitizing HTML elements, attributes, and more.

README

micromark-util-sanitize-uri

micromark utility to sanitize urls.

Contents

• Install
• Use
• API
  • sanitizeUri(url[, pattern])
• Security
• Contribute
• License

Install

npm:

npm install micromark-util-sanitize-uri

Use

import {sanitizeUri} from 'micromark-util-sanitize-uri'

sanitizeUri('https://example.com/a&b') // 'https://example.com/a&b'
sanitizeUri('https://example.com/a%b') // 'https://example.com/a%25b'
sanitizeUri('https://example.com/a%20b') // 'https://example.com/a%20b'
sanitizeUri('https://example.com/👍') // 'https://example.com/%F0%9F%91%8D'
sanitizeUri('https://example.com/', /^https?$/i) // 'https://example.com/'
sanitizeUri('javascript:alert(1)', /^https?$/i) // ''
sanitizeUri('./example.jpg', /^https?$/i) // './example.jpg'
sanitizeUri('#a', /^https?$/i) // '#a'

API

This module exports the following identifiers: sanitizeUri. There is no default export.

sanitizeUri(url[, pattern])

Make a value safe for injection as a URL.

This encodes unsafe characters with percent-encoding and skips already encoded sequences (see normalizeUri internally). Further unsafe characters are encoded as character references (see micromark-util-encode).

A regex of allowed protocols can be given, in which case the URL is sanitized. For example, /^(https?|ircs?|mailto|xmpp)$/i can be used for a[href], or /^https?$/i for img[src] (this is what github.com allows). If the URL includes an unknown protocol (one not matched by protocol, such as a dangerous example, javascript:), the value is ignored.

Parameters

• url (string) — URI to sanitize.
• pattern (RegExp, optional) — Allowed protocols.

Returns

string — Sanitized URI.

Security

See security.md in micromark/.github for how to submit a security report.

Contribute

See contributing.md in micromark/.github for ways to get started. See support.md for ways to get help.

This project has a code of conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.

License

MIT © Titus Wormer