chore: import upstream snapshot with attribution

2026-07-13 13:32:57 +08:00
commit cd420f9332
4811 changed files with 884702 additions and 0 deletions
@@ -0,0 +1,14 @@
+// Return the URL only if it uses an http(s) scheme, else `undefined` so callers
+// can fall back to a default. Use for any URL rendered into an `<a href>`.
+
+const SAFE_HTTP_PROTOCOLS = new Set(["http:", "https:"]);
+
+export function sanitizeHttpUrl(url: string | undefined | null): string | undefined {
+  if (!url) return undefined;
+  try {
+    const parsed = new URL(url);
+    return SAFE_HTTP_PROTOCOLS.has(parsed.protocol) ? parsed.href : undefined;
+  } catch {
+    return undefined;
+  }
+}