comark/annotate/unsafe-bound-url · Bind src and href to http:// or https:// URLs

Comark drops a bound src or href that resolves to a script URL, such as javascript:, so the screenshot loses its image or its link. Bind it to an http:// or https:// URL, or for src a path to the image.

Incorrect

---
pond: "javascript:alert('quack')"
---

::screenshot{src="/pond.png" alt="The pond map with three ducks" :href="frontmatter.pond"}
::

lint-comark example.mdexample.md:5:19 comark/annotate/unsafe-bound-urlscreenshot "/pond.png": :href resolves to an unsafe URL, so it's left out.Use an http:// or https:// URL.✖ 1 problem

Correct

---
pond: "https://pond.example.com/map"
---

::screenshot{src="/pond.png" alt="The pond map with three ducks" :href="frontmatter.pond"}
::

lint-comark example.md✔ No problems