micromark-util-sanitize-uri
Advanced tools
Package description
The micromark-util-sanitize-uri npm package is designed to sanitize URLs within markdown content. It ensures that the URLs are safe to use by escaping or removing potentially harmful elements. This is particularly useful in preventing XSS (Cross-Site Scripting) attacks and other vulnerabilities that can arise from malicious URLs.
Sanitize URLs
This feature allows you to sanitize URLs to ensure they are safe to use. It converts potentially dangerous URLs (like those starting with 'javascript:') into harmless ones (e.g., 'about:blank'), while leaving safe URLs unchanged.
"use strict";
var sanitize = require('micromark-util-sanitize-uri');
var safeUrl = sanitize('javascript:alert(document.cookie)');
console.log(safeUrl); // Logs: 'about:blank'
var safeUrl2 = sanitize('https://example.com');
console.log(safeUrl2); // Logs: 'https://example.com'Like micromark-util-sanitize-uri, sanitize-url is designed to make URLs safe to use by sanitizing them. It removes or escapes parts of the URL that could be used for XSS attacks. The main difference is in the specific implementation and API design, where sanitize-url might offer different or additional options for sanitization.
DOMPurify is a more general-purpose library for sanitizing HTML and preventing XSS attacks. While it can be used to sanitize URLs within HTML content, it is broader in scope compared to micromark-util-sanitize-uri, which focuses specifically on URLs within markdown. DOMPurify provides a wide range of options for sanitizing HTML elements, attributes, and more.
Readme
micromark utility to sanitize urls.
This package exposes an algorithm to make URLs safe.
This package might be useful when you are making your own micromark extensions.
This package is ESM only. In Node.js (version 16+), install with npm:
npm install micromark-util-sanitize-uri
In Deno with esm.sh:
import {sanitizeUri} from 'https://esm.sh/micromark-util-sanitize-uri@1'
In browsers with esm.sh:
<script type="module">
import {sanitizeUri} from 'https://esm.sh/micromark-util-sanitize-uri@1?bundle'
</script>
import {sanitizeUri} from 'micromark-util-sanitize-uri'
sanitizeUri('https://example.com/a&b') // 'https://example.com/a&amp;b'
sanitizeUri('https://example.com/a%b') // 'https://example.com/a%25b'
sanitizeUri('https://example.com/a%20b') // 'https://example.com/a%20b'
sanitizeUri('https://example.com/👍') // 'https://example.com/%F0%9F%91%8D'
sanitizeUri('https://example.com/', /^https?$/i) // 'https://example.com/'
sanitizeUri('javascript:alert(1)', /^https?$/i) // ''
sanitizeUri('./example.jpg', /^https?$/i) // './example.jpg'
sanitizeUri('#a', /^https?$/i) // '#a'
This module exports the identifiers normalizeUri and
sanitizeUri.
There is no default export.
normalizeUri(value)Normalize a URL.
Encode unsafe characters with percent-encoding, skipping already encoded sequences.
value (string)
— URI to normalizeNormalized URI (string).
sanitizeUri(url[, pattern])Make a value safe for injection as a URL.
This encodes unsafe characters with percent-encoding and skips already
encoded sequences (see normalizeUri).
Further unsafe characters are encoded as character references (see
micromark-util-encode).
A regex of allowed protocols can be given, in which case the URL is sanitized.
For example, /^(https?|ircs?|mailto|xmpp)$/i can be used for a[href], or
/^https?$/i for img[src] (this is what github.com allows).
If the URL includes an unknown protocol (one not matched by protocol, such
as a dangerous example, javascript:), the value is ignored.
url (string)
— URI to sanitizepattern (RegExp, optional)
— allowed protocolsSanitized URI (string).
This package is fully typed with TypeScript. It exports no additional types.
Projects maintained by the unified collective are compatible with all maintained versions of Node.js. As of now, that is Node.js 16+. Our projects sometimes work with older versions, but this is not guaranteed.
This package works with micromark version 3+.
This package is safe.
See security.md in micromark/.github for how to
submit a security report.
See contributing.md in micromark/.github for ways
to get started.
See support.md for ways to get help.
This project has a code of conduct. By interacting with this repository, organisation, or community you agree to abide by its terms.
FAQs
micromark utility to sanitize urls
The npm package micromark-util-sanitize-uri receives a total of 4,667,025 weekly downloads. As such, micromark-util-sanitize-uri popularity was classified as popular.
We found that micromark-util-sanitize-uri demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Git dependencies in open source packages can introduce significant risks, including lack of version control, stability issues, dependency drift, and difficulty in auditing, making them potential targets for supply chain attacks.
Security News
Node.js has added experimental support for TypeScript, a move that highlights the growing importance of TypeScript in modern development.
Product
Check out what's new at Socket with our Product Changelog. It tracks all public-facing updates, improvements, and fixes so you can take full advantage of our features.