Renders a URL for interpolation into a quoted HTML attribute (href="...").
HTML-escaping alone is not enough for a URL: javascript:alert(1) contains
no characters escapeHtml touches, so it survives escaping and still runs
on click. This parses the value, allows only absolute http:/https: URLs,
and escapes the result so it cannot break out of the attribute.
Returns an empty string for anything that fails to parse or uses another
scheme (javascript:, data:, mailto:, relative paths).
Renders a URL for interpolation into a quoted HTML attribute (
href="...").HTML-escaping alone is not enough for a URL:
javascript:alert(1)contains no charactersescapeHtmltouches, so it survives escaping and still runs on click. This parses the value, allows only absolutehttp:/https:URLs, and escapes the result so it cannot break out of the attribute.Returns an empty string for anything that fails to parse or uses another scheme (
javascript:,data:,mailto:, relative paths).