diff --git a/src/__tests__/index.test.ts b/src/__tests__/index.test.ts index 180d891..0145a86 100644 --- a/src/__tests__/index.test.ts +++ b/src/__tests__/index.test.ts @@ -146,7 +146,7 @@ describe("sanitizeUrl", () => { expect(sanitizeUrl(vector)).toBe(BLANK_URL); }); }); - + it("backslash prefixed attack vectors", () => { const attackVectors = [ "\fjavascript:alert()", @@ -156,7 +156,7 @@ describe("sanitizeUrl", () => { "\rjavascript:alert()", "\u0000javascript:alert()", "\u0001javascript:alert()", - "\j\av\a\s\cript:alert()", + "\\j\\av\\a\\s\\cript:alert()", ]; attackVectors.forEach((vector) => { diff --git a/src/index.ts b/src/index.ts index 6c11dec..3297bba 100644 --- a/src/index.ts +++ b/src/index.ts @@ -21,12 +21,7 @@ function decodeHtmlCharacters(str: string) { } function isValidUrl(url: string): boolean { - try { - new URL(url); - return true; - } catch (e) { - return false; - } + return URL.canParse(url); } function decodeURI(uri: string): string { @@ -89,12 +84,12 @@ export function sanitizeUrl(url?: string): string { } // Handle special cases for mailto: and custom deep-link protocols - if (urlScheme === 'mailto:' || urlScheme.includes('://')) { + if (urlScheme === "mailto:" || urlScheme.includes("://")) { return trimmedUrl; } // For http and https URLs, perform additional validation - if (urlScheme === 'http:' || urlScheme === 'https:') { + if (urlScheme === "http:" || urlScheme === "https:") { if (!isValidUrl(trimmedUrl)) { return BLANK_URL; }