Decide whether value is safe to interpolate into a mailto: URI.
The check rejects values that do not match the standard email format
pattern. The format pattern excludes whitespace, but it does permit
%, and a browser decodes percent-escapes at click time — so a value
such as "foo%0Abcc:victim@bar.com" would inject a Bcc: header into
the resulting mailto: URI. Refuse any value containing % to close
that header-injection vector. The plain email-format regex stays a
pure email-syntax check; the additional % filter lives here so other
callers of the format pattern (form validators, JSON Schema
format: email checks) are not affected.
Decide whether
valueis safe to interpolate into amailto:URI.The check rejects values that do not match the standard email format pattern. The format pattern excludes whitespace, but it does permit
%, and a browser decodes percent-escapes at click time — so a value such as"foo%0Abcc:victim@bar.com"would inject aBcc:header into the resultingmailto:URI. Refuse any value containing%to close that header-injection vector. The plain email-format regex stays a pure email-syntax check; the additional%filter lives here so other callers of the format pattern (form validators, JSON Schemaformat: emailchecks) are not affected.