heygo/src/lib/url.ts

// Pure URL-safety helper for rendering link targets.
// The server already validates http/https on write, but this is a
// client-side defense-in-depth check so a stale or malicious row can never
// produce a clickable javascript:/data:/etc. anchor in the UI.

/**
 * Returns the URL only when it uses an http: or https: scheme (case-insensitive).
 * Returns null for null/empty input, non-http schemes (javascript:, data:, mailto:,
 * ftp:, file:), protocol-relative URLs (//host), and bare paths.
 */
export function safeLinkTargetUrl(url: string | null): string | null {
  if (!url) {
    return null;
  }
  const trimmed = url.trim();
  if (!trimmed) {
    return null;
  }
  return /^https?:\/\//i.test(trimmed) ? trimmed : null;
}