sanitizeUrl
Function Stability: stable
Return url when it is safe to put in an href / src, otherwise null.
kind: 'link'(default): http, https, mailto, tel, relative URLs,#fragment.kind: 'media': http, https, relative,blob:,data:image/*,data:video/*, and Nabu's internalnabu-asset:scheme (see Files).
Everything else (javascript:, vbscript:, data:text/html, file:…) is refused, including obfuscated forms:
surrounding / embedded whitespace and control characters (java\nscript:), mixed case, and HTML-entity-encoded
schemes (javascript:). The URL is returned UNCHANGED (callers still have to escape it for the attribute).
Signature
TypeScript
import { sanitizeUrl } from '@aionbuilders/nabu';TypeScript
function sanitizeUrl(url: unknown, options?: object): string | nullParameters
| Parameter | Type | Default | Description |
|---|---|---|---|
url | unknown | n/a | n/a |
optionsoptional | object | {} | n/a |
options.kindoptional | 'media' | 'link' | 'link' | n/a |
Returns
string | null
Source: src/lib/utils/html.js:118