Documentation / @zerotal/flow / index / isSafeUrl

Function: isSafeUrl()

isSafeUrl(url): boolean

Whether a URL is safe to put in a navigable attribute.

Relative URLs, fragments, query-only URLs and the ordinary network schemes are safe. javascript: and vbscript: execute on click; data:text/html and data:image/svg+xml execute in the document's own origin when navigated to. Everything is checked after stripping the whitespace and control characters browsers ignore while parsing a scheme — java\tscript:alert(1) and JaVaScRiPt:alert(1) both navigate.

Parameters

url

string

The candidate URL.

Returns

boolean

true when the browser will treat it as a resource reference rather than code.

Example

isSafeUrl("/dashboard")                 // true
isSafeUrl("https://example.com")        // true
isSafeUrl("java\tscript:alert(1)")      // false