index.js 854 B

1234567891011121314151617181920212223242526272829303132333435363738394041
  1. 'use strict';
  2. var invalidPrototcolRegex = /^(%20|\s)*(javascript|data)/im;
  3. var ctrlCharactersRegex = /[^\x20-\x7E]/gmi;
  4. var urlSchemeRegex = /^([^:]+):/gm;
  5. var relativeFirstCharacters = ['.', '/']
  6. function isRelativeUrl(url) {
  7. return relativeFirstCharacters.indexOf(url[0]) > -1;
  8. }
  9. function sanitizeUrl(url) {
  10. if (!url) {
  11. return 'about:blank';
  12. }
  13. var urlScheme, urlSchemeParseResults;
  14. var sanitizedUrl = url.replace(ctrlCharactersRegex, '').trim();
  15. if (isRelativeUrl(sanitizedUrl)) {
  16. return sanitizedUrl;
  17. }
  18. urlSchemeParseResults = sanitizedUrl.match(urlSchemeRegex);
  19. if (!urlSchemeParseResults) {
  20. return 'about:blank';
  21. }
  22. urlScheme = urlSchemeParseResults[0];
  23. if (invalidPrototcolRegex.test(urlScheme)) {
  24. return 'about:blank';
  25. }
  26. return sanitizedUrl;
  27. }
  28. module.exports = {
  29. sanitizeUrl: sanitizeUrl
  30. };