{"_id":"strict-url-sanitise","name":"strict-url-sanitise","dist-tags":{"latest":"0.0.1"},"versions":{"0.0.1":{"name":"strict-url-sanitise","version":"0.0.1","description":"Strict URL sanitization with security-focused validation","type":"module","main":"./dist/index.js","module":"./dist/index.js","types":"./dist/index.d.ts","exports":{".":{"import":"./dist/index.js","types":"./dist/index.d.ts"}},"scripts":{"build":"tsup","build:watch":"tsup --watch","test":"vitest run","test:watch":"vitest","check":"tsc --noEmit"},"keywords":["url","sanitize","security","validation"],"author":{"name":"Glen Maddern","email":"glen@glenmaddern.com"},"repository":{"type":"git","url":"git+https://github.com/geelen/strict-url-sanitise.git"},"license":"MIT","devDependencies":{"tsup":"^8.0.0","typescript":"^5.0.0","vitest":"^2.0.0"},"_id":"strict-url-sanitise@0.0.1","gitHead":"83a9935531cf6f818d2b6c9e241d1b7bdeffba7a","bugs":{"url":"https://github.com/geelen/strict-url-sanitise/issues"},"homepage":"https://github.com/geelen/strict-url-sanitise#readme","_nodeVersion":"22.16.0","_npmVersion":"10.9.2","dist":{"integrity":"sha512-nuFtF539K8jZg3FjaWH/L8eocCR6gegz5RDOsaWxfdbF5Jqr2VXWxZayjTwUzsWJDC91k2EbnJXp6FuWW+Z4hg==","shasum":"10cfac63c9dfdd856d98ab9f76433dad5ce99e0c","tarball":"https://registry.npmjs.org/strict-url-sanitise/-/strict-url-sanitise-0.0.1.tgz","fileCount":4,"unpackedSize":3979,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEQCIHz5qISmb12DGWcgw0IidVEmv/q0oWGTbPoFBXOyZtSJAiAdoSntU2iqBbgSa7vOjUW+m92S+QTy9xxlSxIHRfRAug=="}]},"_npmUser":{"name":"geelen","email":"glen@glenmaddern.com","actor":{"name":"geelen","email":"glen@glenmaddern.com","type":"user"}},"directories":{},"maintainers":[{"name":"geelen","email":"glen@glenmaddern.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/strict-url-sanitise_0.0.1_1750912788779_0.7786528117334643"},"_hasShrinkwrap":false}},"time":{"created":"2025-06-26T04:39:48.778Z","0.0.1":"2025-06-26T04:39:48.942Z","modified":"2025-06-26T04:39:49.190Z"},"maintainers":[{"name":"geelen","email":"glen@glenmaddern.com"}],"description":"Strict URL sanitization with security-focused validation","homepage":"https://github.com/geelen/strict-url-sanitise#readme","keywords":["url","sanitize","security","validation"],"repository":{"type":"git","url":"git+https://github.com/geelen/strict-url-sanitise.git"},"author":{"name":"Glen Maddern","email":"glen@glenmaddern.com"},"bugs":{"url":"https://github.com/geelen/strict-url-sanitise/issues"},"license":"MIT","readme":"# strict-url-sanitise\n\nStrict URL sanitization with security-focused validation to prevent XSS and command injection attacks.\n\n## Installation\n\n```bash\npnpm add -D strict-url-sanitise\n```\n\n## Usage\n\n```typescript\nimport { sanitizeUrl } from 'strict-url-sanitise'\n\n// Valid URLs are sanitized and returned\nconst safe = sanitizeUrl('https://example.com/path?param=value')\nconsole.log(safe) // 'https://example.com/path?param=value'\n\n// Invalid URLs throw an error\ntry {\n  sanitizeUrl('javascript:alert(\"XSS\")')\n} catch (error) {\n  console.log(error.message) // 'Invalid url to pass to open(): javascript:alert(\"XSS\")'\n}\n```\n\n## Blocked URLs\n\nThis library blocks the following types of potentially dangerous URLs:\n\n### Non-HTTP(S) Protocols\n```javascript\nsanitizeUrl('ftp://example.com/test')                    // ❌ Throws\nsanitizeUrl('file:///etc/passwd')                        // ❌ Throws  \nsanitizeUrl('javascript:alert(\"XSS\")')                   // ❌ Throws\nsanitizeUrl('data:text/html,<script>alert(1)</script>')  // ❌ Throws\n```\n\n### Command Injection Attempts\n```javascript\nsanitizeUrl('https://www.$(calc.exe).com/foo')           // ❌ Throws\nsanitizeUrl('javascript:$(cmd /c whoami)')               // ❌ Throws\n```\n\n### Invalid Hostnames\n```javascript\nsanitizeUrl('https://exam ple.com')                      // ❌ Throws (spaces)\n```\n\n## What Gets Sanitized\n\nValid HTTP(S) URLs have their components properly encoded:\n\n```javascript\n// Special characters in paths, queries, and fragments are encoded\nsanitizeUrl('https://example.com/path with spaces')\n// → 'https://example.com/path%2520with%2520spaces'\n\nsanitizeUrl('https://example.com?key=value with spaces')  \n// → 'https://example.com/?key=value%20with%20spaces'\n\n// Basic auth credentials are encoded\nsanitizeUrl('http://user$(test):pass$(test)@domain.com')\n// → 'http://user%24(test):pass%24(test)@domain.com/'\n```\n\nThis may catch some valid URLs unintentionally but this package is explicitly designed to be as safe as possible to start, then relaxed over time if counter-examples are provided.\n\n## License\n\nMIT\n","readmeFilename":"README.md","_rev":"1-4af80ddb9ce933d1c34836e00c5aa6bb"}