function sanitizeUrl(value) {
  return value.replace(URL_RE, (match, before, url, after) => {
    let quote = '';
    url = url.replace(/^(['"])(.*)\1$/, (match, start, inside) => {
      quote = start;
      return inside;
    });
    const sanitized = SafeUrl.sanitize(url).getTypedStringValue();
    return before + quote + sanitized + quote + after;
  });
}
Sanitize URLs inside url().
NOTE: We could also consider using CSS.escape once that's available in the
browsers. However, loosely matching URL e.g. with url\(.*\) and then escaping
the contents would result in a slightly different language than CSS leading
to confusion of users. E.g. url(")") is valid in CSS but it would be invalid
as seen by our parser. On the other hand, url(\) is invalid in CSS but our
parser would be fine with it.
@param {string} value Untrusted CSS property value.
@return {string}