You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

109 lines
3.1 KiB

3 months ago
  1. # Encode URL
  2. Encode a URL to a percent-encoded form, excluding already-encoded sequences.
  3. ## Installation
  4. ```sh
  5. npm install encodeurl
  6. ```
  7. ## API
  8. ```js
  9. var encodeUrl = require('encodeurl')
  10. ```
  11. ### encodeUrl(url)
  12. Encode a URL to a percent-encoded form, excluding already-encoded sequences.
  13. This function accepts a URL and encodes all the non-URL code points (as UTF-8 byte sequences). It will not encode the "%" character unless it is not part of a valid sequence (`%20` will be left as-is, but `%foo` will be encoded as `%25foo`).
  14. This encode is meant to be "safe" and does not throw errors. It will try as hard as it can to properly encode the given URL, including replacing any raw, unpaired surrogate pairs with the Unicode replacement character prior to encoding.
  15. ## Examples
  16. ### Encode a URL containing user-controlled data
  17. ```js
  18. var encodeUrl = require('encodeurl')
  19. var escapeHtml = require('escape-html')
  20. http.createServer(function onRequest (req, res) {
  21. // get encoded form of inbound url
  22. var url = encodeUrl(req.url)
  23. // create html message
  24. var body = '<p>Location ' + escapeHtml(url) + ' not found</p>'
  25. // send a 404
  26. res.statusCode = 404
  27. res.setHeader('Content-Type', 'text/html; charset=UTF-8')
  28. res.setHeader('Content-Length', String(Buffer.byteLength(body, 'utf-8')))
  29. res.end(body, 'utf-8')
  30. })
  31. ```
  32. ### Encode a URL for use in a header field
  33. ```js
  34. var encodeUrl = require('encodeurl')
  35. var escapeHtml = require('escape-html')
  36. var url = require('url')
  37. http.createServer(function onRequest (req, res) {
  38. // parse inbound url
  39. var href = url.parse(req)
  40. // set new host for redirect
  41. href.host = 'localhost'
  42. href.protocol = 'https:'
  43. href.slashes = true
  44. // create location header
  45. var location = encodeUrl(url.format(href))
  46. // create html message
  47. var body = '<p>Redirecting to new site: ' + escapeHtml(location) + '</p>'
  48. // send a 301
  49. res.statusCode = 301
  50. res.setHeader('Content-Type', 'text/html; charset=UTF-8')
  51. res.setHeader('Content-Length', String(Buffer.byteLength(body, 'utf-8')))
  52. res.setHeader('Location', location)
  53. res.end(body, 'utf-8')
  54. })
  55. ```
  56. ## Similarities
  57. This function is _similar_ to the intrinsic function `encodeURI`. However, it will not encode:
  58. * The `\`, `^`, or `|` characters
  59. * The `%` character when it's part of a valid sequence
  60. * `[` and `]` (for IPv6 hostnames)
  61. * Replaces raw, unpaired surrogate pairs with the Unicode replacement character
  62. As a result, the encoding aligns closely with the behavior in the [WHATWG URL specification][whatwg-url]. However, this package only encodes strings and does not do any URL parsing or formatting.
  63. It is expected that any output from `new URL(url)` will not change when used with this package, as the output has already been encoded. Additionally, if we were to encode before `new URL(url)`, we do not expect the before and after encoded formats to be parsed any differently.
  64. ## Testing
  65. ```sh
  66. $ npm test
  67. $ npm run lint
  68. ```
  69. ## References
  70. - [RFC 3986: Uniform Resource Identifier (URI): Generic Syntax][rfc-3986]
  71. - [WHATWG URL Living Standard][whatwg-url]
  72. [rfc-3986]: https://tools.ietf.org/html/rfc3986
  73. [whatwg-url]: https://url.spec.whatwg.org/
  74. ## License
  75. [MIT](LICENSE)