@revenuecat/purchases-ui-js/dist/components/web-view/web-view-utils.d.ts

Web components for Paywalls. Powered by RevenueCat

/**
 * Returns a sanitized URL if it is a well-formed absolute `https:` URL,
 * otherwise `null`.
 *
 * The web view embeds remote, third-party bundles, so only `https` is allowed:
 * `http`, `data:`, `blob:`, `javascript:`, protocol-relative (`//host`) and
 * relative URLs are all rejected, as are URLs carrying embedded credentials
 * (`https://user:pass@host`). Whitespace and control characters (code points
 * <= 0x20) are stripped before validation so obfuscated payloads such as
 * "https\t://" or "jAvAsCrIpT:" cannot slip through. The normalized, parsed
 * `href` is returned (not the raw input) so no control characters reach the
 * iframe `src`.
 */
export declare function sanitizeWebViewUrl(url: string): string | null;
/**
 * Returns whether `url` resolves to the same origin as `hostOrigin` (typically
 * `window.location.origin`). Used as a guard before applying the
 * `allow-scripts allow-same-origin` sandbox: that combination is only safe when
 * the framed bundle is on a different origin than the host page, otherwise it
 * could script and un-sandbox the host. Callers should pass an already
 * sanitized URL; an unparseable URL conservatively reports `true` (treat as
 * same-origin -> block).
 */
export declare function isSameOriginAsHost(url: string, hostOrigin: string): boolean;