AG-41531 Improve 'href-sanitizer ' — support uBO arguments. #493

Squashed commit of the following:

commit 13e2ec1
Author: Adam Wróblewski <[email protected]>
Date:   Wed Aug 20 11:26:46 2025 +0200

    Add alias `-base64` for `base64decode` in `href-sanitizer` scriptlet

Author: AdamWr

CHANGELOG.md

@@ -10,6 +10,15 @@ The format is based on [Keep a Changelog], and this project adheres to [Semantic
 <!-- TODO: change `@added unknown` tag due to the actual version -->
 <!--       during new scriptlets or redirects releasing -->
 
+## [Unreleased]
+
+### Added
+
+- `-base64` as an alias of `base64decode` in `href-sanitizer` scriptlet [#493].
+
+[Unreleased]: https://github.com/AdguardTeam/Scriptlets/compare/v2.2.9...HEAD
+[#493]: https://github.com/AdguardTeam/Scriptlets/issues/493
+
 ## [v2.2.9] - 2025-08-14
 
 ### Added

src/scriptlets/href-sanitizer.ts

@@ -32,6 +32,7 @@ import { type Source } from './scriptlets';
  *     - `?<parameter-name>` copy the value from URL parameter `parameter-name` of the same element's `href` attribute.
  * - `transform` — optional, defaults to no transforming. Possible values:
  *     - `base64decode` — decode the base64 string from specified attribute.
+ *       `-base64` can be used as an alias.
  *     - `removeHash` — remove the hash from the URL.
  *     - `removeParam[:<parameters>]` — remove the specified parameters from the URL,
  *       where `<parameters>` is a comma-separated list of parameter names;
@@ -183,7 +184,10 @@ export function hrefSanitizer(
     }
 
     // transform markers
-    const BASE64_DECODE_TRANSFORM_MARKER = 'base64decode';
+    const BASE64_DECODE_TRANSFORM_MARKER = new Set([
+        'base64decode',
+        '-base64',
+    ]);
     const REMOVE_HASH_TRANSFORM_MARKER = 'removeHash';
     const REMOVE_PARAM_TRANSFORM_MARKER = 'removeParam';
     // separator markers
@@ -510,7 +514,7 @@ export function hrefSanitizer(
                 // apply transform if specified
                 if (transform) {
                     switch (true) {
-                        case transform === BASE64_DECODE_TRANSFORM_MARKER:
+                        case BASE64_DECODE_TRANSFORM_MARKER.has(transform):
                             newHref = base64Decode(newHref);
                             break;
                         case transform === REMOVE_HASH_TRANSFORM_MARKER:

tests/scriptlets/href-sanitizer.test.js

@@ -214,6 +214,18 @@ test('Sanitize href - base64 where link decoded in object in search query ', (as
     assert.strictEqual(window.hit, 'FIRED');
 });
 
+test('Sanitize href - decode base64 string in href attribute - test for alias "-base64"', (assert) => {
+    const expectedHref = 'http://example.com/?v=123';
+    const hrefWithBase64 = 'http://www.foo.com/out/?aHR0cDovL2V4YW1wbGUuY29tLz92PTEyMw==';
+    const elem = createElem(hrefWithBase64);
+    const selector = 'a[href*="out/?"]';
+    const scriptletArgs = [selector, '[href]', '-base64'];
+    runScriptlet(name, scriptletArgs);
+
+    assert.strictEqual(elem.getAttribute('href'), expectedHref, 'href has been sanitized and base64 was decoded');
+    assert.strictEqual(window.hit, 'FIRED');
+});
+
 test('Sanitize href - text content', (assert) => {
     const expectedHref = 'https://example.org/';
     const elem = createElem('https://example.com/foo?redirect=https%3A%2F%2Fexample.org%2F', expectedHref);