Throw error on view-source: input (#118)

sindresorhus · Oct 10, 2020 · 3a9d450 · 3a9d450
1 parent fe36714
commit 3a9d450
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/index.js b/index.js
@@ -83,6 +83,10 @@ const normalizeUrl = (urlString, options) => {
 		return normalizeDataURL(urlString, options);
 	}
 
+	if (/^view-source:/i.test(urlString)) {
+		throw new Error('`view-source:` is not supported as it is a non-standard protocol');
+	}
+
 	const hasRelativeProtocol = urlString.startsWith('//');
 	const isRelativeUrl = !hasRelativeProtocol && /^\.*\//.test(urlString);
 

diff --git a/test.js b/test.js
@@ -314,3 +314,9 @@ test('prevents homograph attack', t => {
 	// The input string uses Unicode to make it look like a valid `ebay.com` URL.
 	t.is(normalizeUrl('https://ebаy.com'), 'https://xn--eby-7cd.com');
 });
+
+test('view-source URL', t => {
+	t.throws(() => {
+		normalizeUrl('view-source:https://www.sindresorhus.com');
+	}, '`view-source:` is not supported as it is a non-standard protocol');
+});