comark/unsafe-url · Keep script URLs out of href and src

A javascript:, vbscript:, or data: URL in an href or src can run script when it's clicked or loaded. data: images are fine. Markdown's own [text](url) links drop these URLs already, so this catches the ones set as attributes.

Incorrect

The pond has a :a[feed the ducks]{href="javascript:alert(1)"} button.

lint-comark example.mdexample.md:1:41 comark/unsafe-urlThe href of a on line 1 is a javascript: URL.Use an https: or relative URL. A javascript:, vbscript:, or non-image data: URL can run script when it's clicked or loaded.✖ 1 problem

Correct

The pond has a :a[feed the ducks]{href="/ducks/feed/"} button.

lint-comark example.md✔ No problems