Proofpoint urldefense.com URL Decoder (v3)

decodeUrlDefensev3.js

/**
 * Decodes a Proofpoint urldefense.com (v3 format)
 * Reference: https://help.proofpoint.com/@api/deki/files/177/URLDefenseDecode.py?revision=2
 * @param {String} link  typical format: 'https://urldefense.com/v3/__<encoded url>__;<replacement characters>!!<assorted click tracking goodness>$'
 */
function decodeUrlDefensev3(link) {
    var matches = link.match(new RegExp('v3/__(.+?)__;(.*?)!'))

    // love me a mutable array
    var decode_pile = Array.from(matches[1]);
    var chars_pile = Array.from(atob(matches[2])).reverse();
    
    for (var match of encoded_url.matchAll(/\*/g)) {
        decode_pile[match.index] = encoded_chars.pop()
    }

    return decode_pile.join('')
}

encoded_url is not defined... should be link...

/**
 * Decodes a Proofpoint urldefense.com (v3 format)
 * Reference: https://help.proofpoint.com/@api/deki/files/177/URLDefenseDecode.py?revision=2
 * @param {String} link  typical format: 'https://urldefense.com/v3/__<encoded url>__;<replacement characters>!!<assorted click tracking goodness>$'
 */
function decodeUrlDefensev3(link) {
    var matches = link.match(new RegExp('v3/__(.+?)__;(.*?)!'))

    // love me a mutable array
    var decode_pile = Array.from(matches[1]);
    var chars_pile = Array.from(atob(matches[2])).reverse();
    
    for (var match of link.matchAll(/\*/g)) {
        decode_pile[match.index] = encoded_chars.pop()
    }

    return decode_pile.join('')
}