Decide whether value is safe to use as an anchor href.
Returns true when the value is either a relative reference (no scheme
component) or an absolute URI using http/https. Returns false
for any other scheme, including dangerous ones like javascript: and
data:, and for any value that splices ASCII tab/newline/NUL bytes
into its scheme — the WHATWG URL parser strips those before scheme
detection, so accepting them would let "java\tscript:alert(1)"
resolve to javascript:alert(1) in a browser.
Decide whether
valueis safe to use as an anchorhref.Returns
truewhen the value is either a relative reference (no scheme component) or an absolute URI usinghttp/https. Returnsfalsefor any other scheme, including dangerous ones likejavascript:anddata:, and for any value that splices ASCII tab/newline/NUL bytes into its scheme — the WHATWG URL parser strips those before scheme detection, so accepting them would let"java\tscript:alert(1)"resolve tojavascript:alert(1)in a browser.