fix: setting to strip directional characters

src/autolinker.ts

@@ -466,6 +466,12 @@ export default class Autolinker {
      */
     private readonly sanitizeHtml: boolean = false; // default value just to get the above doc comment in the ES5 output and documentation generator
 
+    /**
+     * @cfg {Boolean} [sanitizeHtml=false]
+     * removes all directional override characters from input string
+     */
+    private readonly stripDirectionalCharacters: boolean = false;
+
     /**
      * @private
      * @property {Autolinker.AnchorTagBuilder} tagBuilder
@@ -497,6 +503,7 @@ export default class Autolinker {
             ? cfg.decodePercentEncoding
             : this.decodePercentEncoding;
         this.sanitizeHtml = cfg.sanitizeHtml || false;
+        this.stripDirectionalCharacters = cfg.stripDirectionalCharacters || false;
 
         // Validate the value of the `mention` cfg
         const mention = this.mention;
@@ -783,6 +790,10 @@ export default class Autolinker {
             textOrHtml = textOrHtml.replace(/</g, '&lt;').replace(/>/g, '&gt;');
         }
 
+        if (this.stripDirectionalCharacters) {
+            textOrHtml = this.stripUnsafeCharacters(textOrHtml);
+        }
+
         let matches = this.parse(textOrHtml),
             newHtml: string[] = [],
             lastIndex = 0;
@@ -854,6 +865,16 @@ export default class Autolinker {
 
         return tagBuilder;
     }
+
+    /**
+     * Strips characters considered as unsafe
+     * SNYK-AUTOLINKER-2438289
+     * @param text
+     * @private
+     */
+    private stripUnsafeCharacters(text: string) {
+        return text.replace(/[\u202a-\u202e\u200e-\u200f]/g, '');
+    }
 }
 
 /**
@@ -944,6 +965,7 @@ export interface AutolinkerConfig {
     context?: any;
     sanitizeHtml?: boolean;
     decodePercentEncoding?: boolean;
+    stripDirectionalCharacters?: boolean;
 }
 
 export type UrlsConfig = boolean | UrlsConfigObj;

tests/autolinker-directional.spec.ts

@@ -0,0 +1,23 @@
+import Autolinker from '../src/autolinker';
+
+describe('Autolinker strip directional characters check -', () => {
+    const autolinker = new Autolinker({
+        newWindow: false,
+        stripDirectionalCharacters: true,
+        stripPrefix: {
+            www: false,
+        },
+    });
+
+    it('should strip out character direction override unicodes', () => {
+        expect(autolinker.link('foo.combar.com')).toBe(
+            '<a href="http://foo.combar.com">foo.combar.com</a>'
+        );
+        expect(autolinker.link('foo.com\u202Ebar.com')).toBe(
+            '<a href="http://foo.combar.com">foo.combar.com</a>'
+        );
+        expect(autolinker.link('foo.com\u202abar.com')).toBe(
+            '<a href="http://foo.combar.com">foo.combar.com</a>'
+        );
+    });
+});