Refactor to improve safe URL detection

Author: wooorm

lib/index.js

@@ -81,6 +81,7 @@
 import{unreachable}from'devlop'
 import{toJsxRuntime}from'hast-util-to-jsx-runtime'
 import{urlAttributes}from'html-url-attributes'
+import{sanitizeUri}from'micromark-util-sanitize-uri'
 // @ts-expect-error: untyped.
 import{Fragment,jsx,jsxs}from'react/jsx-runtime'
 importremarkParsefrom'remark-parse'
@@ -89,8 +90,6 @@ import {unified} from 'unified'
 import{visit}from'unist-util-visit'
 import{VFile}from'vfile'
 
-constsafeProtocols=['http','https','mailto','tel']
-
 constown={}.hasOwnProperty
 constchangelog=
 'https://github.com/remarkjs/react-markdown/blob/main/changelog.md'
@@ -99,6 +98,7 @@ const changelog =
 constemptyPlugins=[]
 /** @type {Readonly<RemarkRehypeOptions>} */
 constemptyRemarkRehypeOptions={allowDangerousHtml: true}
+constsafeProtocol=/^(https?|ircs?|mailto|xmpp)$/i
 
 // Mutable because we `delete` any time it’s used and a message is sent.
 /** @type {ReadonlyArray<Readonly<Deprecation>>} */
@@ -293,38 +293,5 @@ export function Markdown(options) {
  * Safe URL.
  */
 exportfunctiondefaultUrlTransform(value){
-consturl=value.trim()
-constfirst=url.charAt(0)
-
-if(first==='#'||first==='/'){
-returnurl
-}
-
-constcolon=url.indexOf(':')
-if(colon===-1){
-returnurl
-}
-
-for(constprotocolofsafeProtocols){
-if(
-colon===protocol.length&&
-url.slice(0,protocol.length).toLowerCase()===protocol
-){
-returnurl
-}
-}
-
-letindex=url.indexOf('?')
-if(index!==-1&&colon>index){
-returnurl
-}
-
-index=url.indexOf('#')
-if(index!==-1&&colon>index){
-returnurl
-}
-
-// To do: is there an alternative?
-// eslint-disable-next-line no-script-url
-return'javascript:void(0)'
+returnsanitizeUri(value,safeProtocol)
 }

test.jsx

@@ -288,43 +288,31 @@ test('react-markdown', async function (t) {
 })
 
 awaitt.test('should make a `javascript:` URL safe',function(){
-constconsoleError=console.error
-console.error=noop
 assert.equal(
 asHtml(<Markdownchildren="[](javascript:alert(1))"/>),
-'<p><a href="javascript:void(0)"></a></p>'
+'<p><a href=""></a></p>'
 )
-console.error=consoleError
 })
 
 awaitt.test('should make a `vbscript:` URL safe',function(){
-constconsoleError=console.error
-console.error=noop
 assert.equal(
 asHtml(<Markdownchildren="[](vbscript:alert(1))"/>),
-'<p><a href="javascript:void(0)"></a></p>'
+'<p><a href=""></a></p>'
 )
-console.error=consoleError
 })
 
 awaitt.test('should make a `VBSCRIPT:` URL safe',function(){
-constconsoleError=console.error
-console.error=noop
 assert.equal(
 asHtml(<Markdownchildren="[](VBSCRIPT:alert(1))"/>),
-'<p><a href="javascript:void(0)"></a></p>'
+'<p><a href=""></a></p>'
 )
-console.error=consoleError
 })
 
 awaitt.test('should make a `file:` URL safe',function(){
-constconsoleError=console.error
-console.error=noop
 assert.equal(
 asHtml(<Markdownchildren="[](file:///etc/passwd)"/>),
-'<p><a href="javascript:void(0)"></a></p>'
+'<p><a href=""></a></p>'
 )
-console.error=consoleError
 })
 
 awaitt.test('should allow an empty URL',function(){
@@ -1054,8 +1042,3 @@ test('react-markdown', async function (t) {
 functionasHtml(input){
 returnrenderToStaticMarkup(input)
 }
-
-/**
- * @returns {undefined}
- */
-functionnoop(){}