isUnsafeUrlAttribute

Reports whether writing value to the attribute name would run script: the URL check that setAttribute, the head registry and the server renderer share. Use it in a custom renderer before writing a URL that came from user data. URL attributes (href, src, action, formaction, xlink:href, srcdoc, poster, data) are unsafe when, after removing control characters, trimming and lowercasing, they start with javascript:, data:text/html or vbscript:. The SVG animation attributes values, from, to and by are checked the same way, each ;-separated entry of values on its own.

Import#

import { isUnsafeUrlAttribute } from "@shadow-js/web/extend";

Signature#

function isUnsafeUrlAttribute(name: string, value: string): boolean

Parameters#

Returns#

true when the value must not be written; false for every other attribute or value.

Examples#

import { isUnsafeUrlAttribute } from "@shadow-js/web/extend";

isUnsafeUrlAttribute("href", " JavaScript:alert(1)"); // true
isUnsafeUrlAttribute("href", "https://example.com"); // false
isUnsafeUrlAttribute("title", "javascript:alert(1)"); // false: not a URL attribute