url-regex-unsafe

Regular expression matching for URL's. Maintained, and browser-friendly version of url-regex. This package is vulnerable to CVE-2020-7661. Works in Node v10.12.0+ and browsers.

Table of Contents

• Foreword
• Install
• Usage
  • Node
  • Browser
• Options
• Quick tips and migration from url-regex
• Contributors
• License

Foreword

url-regex-unsafe is a fork of url-regex-safe, which is a fork of url-regex. url-regex-safe has resolved CVE-2020-7661 on Node by including RE2 for Node.js usage. However, RE2 does not support lookahead assertions in regular expressions, which leads to some limitations. To avoid these limitations, url-regex-unsafe gets rid of RE2 and uses built-in RegExp instead. This means that url-regex-unsafe is still vulnerable to CVE-2020-7661.

Install

npm:

npm install url-regex-unsafe

yarn:

yarn add url-regex-unsafe

Usage

Node

const urlRegexUnsafe = require('url-regex-unsafe');

const str = 'some long string with url.com in it';
const matches = str.match(urlRegexUnsafe());

for (const match of matches) {
  console.log('match', match);
}

console.log(urlRegexUnsafe({ exact: true }).test('github.com'));

Browser

VanillaJS

This is the solution for you if you're just using <script> tags everywhere!

<script src="https://unpkg.com/url-regex-unsafe"></script>
<script type="text/javascript">
  (function () {
    var str = 'some long string with url.com in it';
    var matches = str.match(urlRegexUnsafe());

    for (var i = 0; i < matches.length; i++) {
      console.log('match', matches[i]);
    }

    console.log(urlRegexUnsafe({ exact: true }).test('github.com'));
  })();
</script>

Bundler

Assuming you are using browserify, webpack, rollup, or another bundler, you can simply follow Node usage above.

TypeScript

This package has built-in support for TypeScript.

Options

| Property | Type | Default Value | Description | | | ---------------- | ------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | - | | exact | Boolean | false | Only match an exact String. Useful with regex.test(str) to check if a String is a URL. We set this to false by default in order to match String values such as github.com (as opposed to requiring a protocol or www subdomain). We feel this closely more resembles real-world intended usage of this package. | | | strict | Boolean | false | Force URL's to start with a valid protocol or www if set to true. If true, then it will allow any TLD as long as it is a minimum of 2 valid characters. If it is false, then it will match the TLD against the list of valid TLD's using tlds. | | | auth | Boolean | false | Match against Basic Authentication headers. We set this to false by default since it was deprecated in Chromium, and otherwise it leaves the user with unwanted URL matches (more closely resembles real-world intended usage of this package by having it set to false by default too). | | | localhost | Boolean | true | Allows localhost in the URL hostname portion. See the test/test.js for more insight into the localhost test and how it will return a value which may be unwanted. A pull request would be considered to resolve the "pic.jp" vs. "pic.jpg" issue. | | | parens | Boolean | false | Match against Markdown-style trailing parenthesis. We set this to false because it should be up to the user to parse for Markdown URL's. | | | apostrophes | Boolean | false | Match against apostrophes. We set this to false because we don't want the String background: url('http://example.com/pic.jpg'); to result in http://example.com/pic.jpg'. See this issue for more information. | | | trailingPeriod | Boolean | false | Match against trailing periods. We set this to false by default since real-world behavior would want example.com versus example.com. as the match (this is different than url-regex where it matches the trailing period in that package). | | | ipv4 | Boolean | true | Match against IPv4 URL's. | | | ipv6 | Boolean | true | Match against IPv6 URL's. | | | tlds | Array | tlds | Match against a specific list of tlds, or the default list provided by tlds. | | | returnString | Boolean | false | Return the RegExp as a String instead of a RegExp (useful for custom logic, such as we did with Spam Scanner). | |

Quick tips and migration from url-regex

You must override the default and set strict: true if you do not wish to match github.com by itself (though www.github.com will work if strict: false).

Unlike the deprecated and unmaintained package url-regex, we do a few things differently:

• We set strict to false by default (url-regex had this set to true)
• We added an auth option, which is set to false by default (url-regex matches against Basic Authentication; had this set to true - however this is a deprecated behavior in Chromium).
• We added parens and ipv6 options, which are set to false and true by default (url-regex had parens set to true and ipv6 was non-existent or set to false rather).
• We added an apostrophe option, which is set to false by default (url-regex had this set to true).
• We added a trailingPeriod option, which is set to false by default (which means matches won't contain trailing periods, whereas url-regex had this set to true).

Contributors

| Name | Website | | -------------------- | ---------------------------- | | ocavue | https://github.com/ocavue/ | | Nick Baugh | http://niftylettuce.com/ | | Kevin Mårtensson | | | Diego Perini | |

License

MIT © ocavue