Raw URL string extracted from content.
Optionaloptions: { allowMailto?: boolean }
Optional toggles for additional allowed schemes.
true only when the URL uses an explicitly allowed scheme and contains no control characters.
isSafeLinkUrl('https://cupthread.com'); // true
isSafeLinkUrl(' HTTPS://cupthread.com '); // true
isSafeLinkUrl('mailto:hi@cupthread.com'); // false
isSafeLinkUrl('mailto:hi@cupthread.com', { allowMailto: true }); // true
isSafeLinkUrl('tel:+18005550199'); // false
isSafeLinkUrl('intent://share#Intent'); // false
isSafeLinkUrl('javascript:alert(1)'); // false
isSafeLinkUrl('java\nscript:alert(1)'); // false
Checks whether a URL coming from untrusted content is safe to open.
URLs containing ASCII control characters are strictly rejected to prevent parser differentials or smuggling exploits. The scheme is extracted after trimming leading/trailing whitespace and normalized to lowercase.