Something went wrong. Try again.
forked from tangled.org/core
Something went wrong. Try again.
TypeScript
123456789101112131415161718// links taken from records (repo website, profile links, .gitmodules) are written by// whoever owns them, and svelte puts any scheme into href. only the schemes a browser// would run as code are dropped; everything else is returned exactly as written.// parsed with URL rather than matched as text, because browsers strip tabs, newlines// and leading spaces first, so "java\tscript:" still runsconst EXECUTABLE = new Set(["javascript:", "vbscript:", "data:"]);
export const safeHref = (raw: string | null | undefined): string | undefined => { if (!raw) return undefined; try { const { protocol } = new URL(raw, "https://relative.invalid/"); return EXECUTABLE.has(protocol) ? undefined : raw; } catch { // nothing that fails to parse can be a script url, so leave it as it was return raw; }};