Documentation / @zerotal/flow / index / sanitizeUrl
Function: sanitizeUrl()
sanitizeUrl(
url):string
Defined in: flow/src/urlSafety.ts:74
Return url when it is safe, or BLOCKED_URL when it would execute.
Applied to every URL-bearing attribute the renderer emits and every one the bridge writes
from server-pushed state, so <a href={this.profile.website}> cannot become one-click XSS
because a user typed a scheme into a profile field.
Parameters
url
string
The candidate URL.
Returns
string
The original URL, or BLOCKED_URL.