/** * @license * Copyright Google LLC * SPDX-License-Identifier: Apache-2.0 */ import '../environment/dev.js'; /** * Extracts the scheme from the given URL. If the URL is relative, https: is * assumed. * @param url The URL to extract the scheme from. * @return the URL scheme. */ export declare function extractScheme(url: string): string | undefined; /** * A pattern that blocks javascript: URLs. Matches * (a) Urls with an explicit scheme that is not javascript and that only has * alphanumeric or [.-+_] characters; or * (b) Urls with no explicit scheme. The pattern allows the first colon * (`:`) character to appear after one of the `/` `?` or `#` characters, * which means the colon appears in path, query or fragment part of the URL. */ export declare const IS_NOT_JAVASCRIPT_URL_PATTERN: RegExp; /** * Checks whether a urls has a `javascript:` scheme. * If the url has a `javascript:` scheme, reports it and returns true. * Otherwise, returns false. */ export declare function reportJavaScriptUrl(url: string): boolean; /** * Checks that the URL scheme is not javascript. * The URL parsing relies on the URL API in browsers that support it. * @param url The URL to sanitize for a SafeUrl sink. * @return undefined if url has a javascript: scheme, the original URL * otherwise. */ export declare function sanitizeJavaScriptUrl(url: string): string | undefined; /** * Type alias for URLs passed to DOM sink wrappers. */ export declare type Url = string; /** * Adapter to sanitize string URLs in DOM sink wrappers. * @return undefined if the URL was sanitized. */ export declare function unwrapUrlOrSanitize(url: Url): string | undefined; /** * Sanitizes a URL restrictively. * This sanitizer protects against XSS and potentially other uncommon and * undesirable schemes that an attacker could use e.g. phishing (tel:, callto: * ssh: etc schemes). This sanitizer is primarily meant to be used by the HTML * sanitizer. */ export declare function restrictivelySanitizeUrl(url: string): string;