code: function isValidUrl(url, allowRelative) {
    if (!url) {
      return false;
    }
    // RFC 3986 (http://tools.ietf.org/html/rfc3986#section-3.1)
    // scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." )
    var protocol = /^[a-z][a-z0-9+\-.]*(?=:)/i.exec(url);
    if (!protocol) {
      return allowRelative;
    }
    protocol = protocol[0].toLowerCase();
    switch (protocol) {
      case 'http':
      case 'https':
      case 'ftp':
      case 'mailto':
      case 'tel':
        return true;
      default:
        return false;
    }
  }
docs: Validates if URL is safe and allowed, e.g. to avoid XSS.