const invalidProtocolRegex = /^([^\w]*)(javascript|data|vbscript)/im ; const ctrlCharactersRegex = /[\u0000-\u001F\u007F-\u009F\u2000-\u200D\uFEFF]/gim ; const urlSchemeRegex = /^([^:]+):/gm ; const relativeFirstCharacters = [ "." , "/" ] ; function isRelativeUrlWithoutProtocol ( url ) { return relativeFirstCharacters . indexOf ( url [ 0 ] ) > - 1 ; } export function sanitizeUrl ( url ? ) { if ( ! url ) { return "about:blank" ; } const sanitizedUrl = url . replace ( ctrlCharactersRegex , "" ) . trim ( ) ; if ( isRelativeUrlWithoutProtocol ( sanitizedUrl ) ) { return sanitizedUrl ; } const urlSchemeParseResults = sanitizedUrl . match ( urlSchemeRegex ) ; if ( ! urlSchemeParseResults ) { return sanitizedUrl ; } const urlScheme = urlSchemeParseResults [ 0 ] ; if ( invalidProtocolRegex . test ( urlScheme ) ) { return "about:blank" ; } return sanitizedUrl ; }