comark/cards/unsafe-link · Keep script URLs out of a card's to

A link card is covered by one link, so a javascript:, vbscript:, or data: URL in to would run on a click anywhere on the card. comark-cards drops the link and renders a plain card, but another renderer, such as Nuxt UI's, may not.

Incorrect

::card{title="Pond report" to="javascript:alert('quack')"}
14 ducks, 3 pigeons.
::

lint-comark example.mdexample.md:1:1 comark/cards/unsafe-link::card 1 ("Pond report"): to must be a page or a web address, so it isn't a link.Change the block as the message says.✖ 1 problem

Correct

::card{title="Pond report" to="/ponds/"}
14 ducks, 3 pigeons.
::

lint-comark example.md✔ No problems