Registry / serialization / micromark-util-sanitize-uri

micromark-util-sanitize-uri

library2.0.1jsnpmunverified

micromark-util-sanitize-uri is a focused utility package within the unified collective's micromark ecosystem, designed to safely normalize and sanitize URIs. It currently operates at version 2.0.1. The package encodes unsafe characters using percent-encoding, skips already encoded sequences, and can further sanitize URIs by validating against a regex of allowed protocols, effectively neutralizing potentially dangerous `javascript:` schemes. This utility is crucial for developers building custom micromark extensions or processing user-generated content, ensuring that URLs rendered in HTML are free from XSS vulnerabilities. As part of the broader micromark project, it follows the unified collective's release cadence, with major versions tied to Node.js LTS support, ensuring compatibility with Node.js 16+ for its current v2 release.

serialization auth-security

npm install micromark-util-sanitize-uri

github ↗package ↗

INSTALL

IMPORT

SIG · MICROMARK-UTIL-SAN

micromark-util-sanitize-uri

serializationjavascriptv2.0.1

Install

—

Import

—

Disk

—

Pass rate

0/ 6

Env Coverage0 / 6

glibc

18–22

musl

18–22

Install & Compatibility

Where this runs

tested against v? · npm install

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

node 18–226 runs

build_error

glibc

node 18–226 runs

build_error

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

sanitizeUri

✓ import { sanitizeUri } from 'micromark-util-sanitize-uri'

✗ const { sanitizeUri } = require('micromark-util-sanitize-uri')

This package is ESM-only. CommonJS `require` will fail.

normalizeUri

✓ import { normalizeUri } from 'micromark-util-sanitize-uri'

✗ const normalizeUri = require('micromark-util-sanitize-uri').normalizeUri

This package is ESM-only. CommonJS `require` will fail.

Demonstrates `sanitizeUri` with protocol filtering and `normalizeUri` for encoding special characters, showing how to make URLs safe for embedding.

import { sanitizeUri, normalizeUri } from 'micromark-util-sanitize-uri'; // Sanitize a URI, disallowing javascript: protocols const safeUrl = sanitizeUri('javascript:alert(1)', /^https?$/i); console.log(`Sanitized dangerous URL: '${safeUrl}'`); // Expected: '' // Normalize a URI, encoding unsafe characters const encodedUrl = normalizeUri('https://example.com/a&b space👍'); console.log(`Normalized URL with special chars: '${encodedUrl}'`); // Expected: 'https://example.com/a&b%20space%F0%9F%91%8D' // Sanitize a relative URL, still allowing it through if protocol pattern is specific const relativeUrl = sanitizeUri('./image.png', /^https?$/i); console.log(`Sanitized relative URL with http/s pattern: '${relativeUrl}'`); // Expected: './image.png' // An example of a valid URL passing through the sanitizer const validUrl = sanitizeUri('https://example.com/path', /^https?$/i); console.log(`Sanitized valid URL: '${validUrl}'`); // Expected: 'https://example.com/path'

Debug

Known issues

breakingThis package is ESM-only. Importing with CommonJS `require()` will result in an error (e.g., `ERR_REQUIRE_ESM`).

fix

Migrate your project to use ES modules (`import`) or use a tool like `esm-interop` if you are stuck on CommonJS.

affects: >=1.0.0

breakingMajor releases of `micromark-util-sanitize-uri` drop support for unmaintained Node.js versions. Version 2.x is compatible with Node.js 16 and higher. Ensure your Node.js environment is up-to-date.

fix

Upgrade your Node.js version to 16 or newer to maintain compatibility. Check the `micromark` monorepo compatibility guidelines for the latest recommendations.

affects: >=2.0.0

gotchaThe `sanitizeUri` function defaults to allowing all protocols if no `pattern` (RegExp) is provided. For security-critical contexts, always provide a strict `pattern` (e.g., `/^https?$/i`) to explicitly allow only safe protocols like `http` and `https`.

fix

When calling `sanitizeUri(url, pattern)`, specify `pattern` as a regular expression matching only the truly safe protocols you intend to permit.

affects: >=1.0.0

Errors

Common errors & fixes

ERR_REQUIRE_ESM

Attempting to import an ESM-only package using CommonJS `require()` syntax.

fix

Change your import statement to `import { sanitizeUri } from 'micromark-util-sanitize-uri';` in an ES module context. Ensure your `package.json` has `"type": "module"` or use `.mjs` file extensions.

TypeError: Cannot destructure property 'sanitizeUri' of ... as it is undefined.

Incorrectly trying to destructure a named export from a `require()` call, or the package was not properly installed.

fix

Verify that `micromark-util-sanitize-uri` is correctly installed (`npm install micromark-util-sanitize-uri`) and that you are using ES module `import` syntax (`import { sanitizeUri } from 'micromark-util-sanitize-uri';`).

Upgrade

Version history

2.0.1latest on npm

Audit

Dependencies

No dependency data recorded yet.

Agent activity

7 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/micromark/micromark.git#main ↗

packagehttps://www.npmjs.com/package/micromark-util-sanitize-uri ↗