39 lines
1.3 KiB
JavaScript
39 lines
1.3 KiB
JavaScript
var invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im;
|
|
var htmlEntitiesRegex = /&#(\w+)(^\w|;)?/g;
|
|
var htmlCtrlEntityRegex = /&(newline|tab);/gi;
|
|
var ctrlCharactersRegex = /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim;
|
|
var urlSchemeRegex = /^.+(:|:)/gim;
|
|
var relativeFirstCharacters = [".", "/"];
|
|
function isRelativeUrlWithoutProtocol(url) {
|
|
return relativeFirstCharacters.indexOf(url[0]) > -1;
|
|
}
|
|
// adapted from https://stackoverflow.com/a/29824550/2601552
|
|
function decodeHtmlCharacters(str) {
|
|
return str.replace(htmlEntitiesRegex, function (match, dec) {
|
|
return String.fromCharCode(dec);
|
|
});
|
|
}
|
|
function sanitizeUrl(url) {
|
|
var sanitizedUrl = decodeHtmlCharacters(url || "")
|
|
.replace(htmlCtrlEntityRegex, "")
|
|
.replace(ctrlCharactersRegex, "")
|
|
.trim();
|
|
if (!sanitizedUrl) {
|
|
return "about:blank";
|
|
}
|
|
if (isRelativeUrlWithoutProtocol(sanitizedUrl)) {
|
|
return sanitizedUrl;
|
|
}
|
|
var urlSchemeParseResults = sanitizedUrl.match(urlSchemeRegex);
|
|
if (!urlSchemeParseResults) {
|
|
return sanitizedUrl;
|
|
}
|
|
var urlScheme = urlSchemeParseResults[0];
|
|
if (invalidProtocolRegex.test(urlScheme)) {
|
|
return "about:blank";
|
|
}
|
|
return sanitizedUrl;
|
|
}
|
|
|
|
window.sanitizeUrl = sanitizeUrl;
|