point-source
35 lines
1.3 KiB
TypeScript
35 lines
1.3 KiB
TypeScript
const SENSITIVE_QUERY_PARAMETER =
|
|
/(?:^|[_-])(access[_-]?token|id[_-]?token|token|secret|password|passwd|auth(?:orization)?|credential|cookie|session|capability|signature|sig|nonce|code|state|key)(?:$|[_-])/i;
|
|
|
|
function safeSearch(search: string): string {
|
|
const kept: string[] = [];
|
|
const params = new URLSearchParams(search);
|
|
params.forEach((value, name) => {
|
|
if (SENSITIVE_QUERY_PARAMETER.test(name)) return;
|
|
kept.push(`${encodeURIComponent(name)}=${encodeURIComponent(value)}`);
|
|
});
|
|
return kept.length ? `?${kept.join("&")}` : "";
|
|
}
|
|
|
|
/** Returns only the stable service identity for a browser preview source. */
|
|
export function previewSourceLabel(value: string): string {
|
|
try {
|
|
const url = new URL(value);
|
|
if (url.origin !== "null") return url.origin;
|
|
} catch {
|
|
// The browser preview normally supplies an absolute URL. Keep the
|
|
// fallback below defensive for malformed or partially typed input.
|
|
}
|
|
return sanitizePreviewPageRoute(value).split("?")[0];
|
|
}
|
|
|
|
/** Keeps the path and non-sensitive query parameters of a rendered page route. */
|
|
export function sanitizePreviewPageRoute(value: string): string {
|
|
try {
|
|
const url = new URL(value, "http://kandev.invalid");
|
|
return `${url.pathname || "/"}${safeSearch(url.search)}`;
|
|
} catch {
|
|
return value.split("#", 1)[0].split("?", 1)[0] || "/";
|
|
}
|
|
}
|