valid-data-url

valid-data-url is a zero-dependency JavaScript module that exports a single function, validDataUrl(s), which tests a string against a regular expression implementing the RFC 2397 data URL grammar: an optional media type, optional parameters, an optional ;base64 flag, and the payload itself. It trims surrounding whitespace before testing and exposes the compiled pattern as a public .regex property so consumers can reuse it directly.

The library traces back to a solution originally shared by Brian Grinstead, later hardened by Jamie Davis to close a ReDoS (regular-expression denial-of-service) exploit in the original pattern. It ships as a UMD module, so it loads the same way under CommonJS (require), AMD (define), or as a global browser script, and its GitHub Actions CI matrix tests every push against Node 14 through 20 with linting, mocha/chai tests, and coverage reporting to Coveralls.

What You Get

• A single validDataUrl(string) function returning a plain boolean
• A public .regex property for direct reuse of the underlying pattern
• UMD packaging that works unmodified in Node, browsers, and AMD loaders
• Zero runtime dependencies and a source file under 1KB

Common Use Cases

• Validating file-upload data URLs before decoding or persisting them
• Sanitizing user-submitted data: URIs in forms or public API payloads
• Guarding image/SVG src attributes against malformed data URLs
• Pre-validating data URLs before handing them to canvas or Image APIs

Under The Hood

Architecture The entire module is a single UMD-wrapped file (index.js) exposing one pure function and one compiled regex; there are no internal layers, classes, or shared state to trace, since the whole implementation is a single regular expression evaluated once per call against a trimmed input string, with validDataUrl.regex exposed as public API for reuse.

Tech Stack Plain JavaScript targeting Node >=14 with zero runtime dependencies, packaged as a UMD bundle so the same file works via CommonJS, AMD, or a global browser script. Dev tooling covers mocha and chai for tests, nyc for coverage (text, html, and lcov output for Coveralls), jshint for linting, and husky for git hooks, with a GitHub Actions matrix running lint, test, and coverage across Node 14, 16, 18, and 20 on every push and pull request.

Code Quality Tests in test.js use mocha/chai against explicit valid and invalid fixture arrays covering base64 images, SVG data URIs, whitespace-padded values, multi-parameter media types, and malformed or empty input, including the undefined-argument case. jshint enforces a consistent style, and CI runs the full lint-test-coverage-coveralls chain on every change. There is no TypeScript or type declaration file, and error handling is intentionally minimal since the function only ever returns a boolean.

What Makes It Unique The library is not conceptually novel — it is a regex implementation of a documented RFC — but its ReDoS hardening is a genuine differentiator: the original naive data-URL regex (still circulating in gists and Stack Overflow answers) was vulnerable to catastrophic backtracking, and this library’s pattern was specifically patched to close that exploit while retaining broad real-world compatibility with base64, SVG, and multi-parameter data URLs.