safeActionUrl

safeActionUrl(url): string | undefined

Defined in: safeUrl.ts:48

Vet a server-supplied action URL before it reaches an <a href>.

Allowed through unchanged:

• absolute https:, http:, mailto:, tel: URLs;
• relative references — /…, ./…, #…, ?… — which resolve against the customer’s own origin; plus protocol-relative //…, which keeps the page’s scheme and is no worse than the absolute https: URLs we already allow (both can point at any host).

Anything else returns undefined: javascript:/data:/vbscript: outright, but also bare strings with no scheme and no relative prefix — we cannot prove where they point, and a CTA with no destination degrades to a plain button, which is the honest outcome.

The input is trimmed first because browsers strip leading ASCII whitespace from href before parsing — without that, " javascript:…" would sneak a scheme past a prefix check that the browser would then honour.

Parameters

url

string | null | undefined

Returns

string | undefined