Breaking Changes
- Decode HTML characters automatically that would result in an XSS vulnerability when rendering links via a server rendered HTML file
// decodes to javacript:alert('XSS')
const vulnerableUrl =
"javascript:alert('XSS')";
sanitizeUrl(vulnerableUrl); // 'about:blank'
const okUrl = "https://example.com/" + vulnerableUrl;
// since the javascript bit is in the path instead of the protocol
// this is successfully sanitized
sanitizeUrl(okUrl); // 'https://example.com/javascript:alert('XSS');
- Fix issue where certain invisible white space characters were not being sanitized (#35)
- Fix issue where certain safe characters were being filtered out (#31 thanks @akirchmyer)
Breaking Changes
- Sanitize vbscript urls (thanks @vicnicius)
- Fixup path to type declaration (closes #25)
- Add typescript types
- Fix issue where urls with accented characters were incorrectly sanitized
Breaking Changes
- Protocol-less urls (ie: www.example.com) will be sanitised and passed on instead of sending out
about:blank
(Thanks @chawes13 #18)
- Trim whitespace from urls
breaking changes
- Replace blank strings with about:blank
- Replace null values with about:blank
- Allow relative urls to be sanitized
- Sanitize malicious URLs that begin with
\s
- Sanitize malicious URLs that begin with %20
- sanitize data: urls
- sanitize javascript: urls