safeUrl
safeUrl(
url):string|null
Defined in: packages/core/src/utils/html.ts:81
Return url if a browser can safely navigate to or load it, else null.
Parameters
Section titled “Parameters”| Parameter | Type |
|---|---|
url | string |
Returns
Section titled “Returns”string | null
Remarks
Section titled “Remarks”escapeHtml alone does not make a URL safe: javascript:alert(1) contains
no character that escaping touches, so it survives into href intact and
executes on click. Schema validation does not catch it either — zod’s
.url() is new URL(), which accepts javascript: as a perfectly
well-formed URL.
Relative, root-relative, fragment, and query references carry no scheme and cannot execute, so they pass through.