# @braintree/sanitize-url

> A url sanitizer

Latest version **7.1.2** (published 2026-01-29) · MIT license · 0 weekly downloads

## Install

```sh
npm install @braintree/sanitize-url
pnpm add @braintree/sanitize-url
yarn add @braintree/sanitize-url
bun add @braintree/sanitize-url
```

## Health

**Score 55/100 (C)** — status: stable.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 7.1.2 |
| Published | 2026-01-29 |
| First published | 2017-08-08 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 27.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 370 |
| Maintainers | braintree |

## Links

- npm: https://www.npmjs.com/package/@braintree/sanitize-url
- Repository: https://github.com/braintree/sanitize-url
- Homepage: https://github.com/braintree/sanitize-url#readme
- Issues: https://github.com/braintree/sanitize-url/issues
- npm.io page: https://npm.io/package/@braintree/sanitize-url

## Recent versions

- 7.1.2 (latest) — 2026-01-29
- 7.1.1 — 2024-12-20
- 7.1.0 — 2024-07-19
- 7.0.4 — 2024-07-02
- 7.0.3 — 2024-06-18
- 7.0.2 — 2024-05-17
- 7.0.1 — 2024-03-18
- 7.0.0 — 2023-12-05
- 6.0.4 — 2023-08-03
- 6.0.3 — 2023-08-01
- 6.0.2 — 2022-11-09
- 6.0.1 — 2022-10-20
- 6.0.0 — 2022-03-01
- 5.0.2 — 2021-06-01
- 5.0.1 — 2021-04-29
- … 12 more at https://npm.io/package/@braintree/sanitize-url/versions

## README

# sanitize-url

## Installation

```sh
npm install -S @braintree/sanitize-url
```

## Usage

```js
var sanitizeUrl = require("@braintree/sanitize-url").sanitizeUrl;

sanitizeUrl("https://example.com"); // 'https://example.com'
sanitizeUrl("http://example.com"); // 'http://example.com'
sanitizeUrl("www.example.com"); // 'www.example.com'
sanitizeUrl("mailto:hello@example.com"); // 'mailto:hello@example.com'
sanitizeUrl(
  "https&#0000058//example.com",
); // https://example.com

sanitizeUrl("javascript:alert(document.domain)"); // 'about:blank'
sanitizeUrl("jAvasCrIPT:alert(document.domain)"); // 'about:blank'
sanitizeUrl(decodeURIComponent("JaVaScRiP%0at:alert(document.domain)")); // 'about:blank'
// HTML encoded javascript:alert('XSS')
sanitizeUrl(
  "&#0000106&#0000097&#0000118&#0000097&#0000115&#0000099&#0000114&#0000105&#0000112&#0000116&#0000058&#0000097&#0000108&#0000101&#0000114&#0000116&#0000040&#0000039&#0000088&#0000083&#0000083&#0000039&#0000041",
); // 'about:blank'
```

## Testing

This library uses [Vitest](https://vitest.dev/). All testing dependencies
will be installed upon `npm install` and the test suite can be executed with
`npm test`. Running the test suite will also run lint checks upon exiting.

    npm test

To generate a coverage report, use `npm run coverage`.

---
_Source: https://npm.io/package/@braintree/sanitize-url · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._