// links taken from records (repo website, profile links, .gitmodules) are written by
// whoever owns them, and svelte puts any scheme into href. only the schemes a browser
// would run as code are dropped; everything else is returned exactly as written.
// parsed with URL rather than matched as text, because browsers strip tabs, newlines
// and leading spaces first, so "java\tscript:" still runs
const EXECUTABLE = new Set(["javascript:", "vbscript:", "data:"]);

export const safeHref = (raw: string | null | undefined): string | undefined => {
	if (!raw) return undefined;
	try {
		const { protocol } = new URL(raw, "https://relative.invalid/");
		return EXECUTABLE.has(protocol) ? undefined : raw;
	} catch {
		// nothing that fails to parse can be a script url, so leave it as it was
		return raw;
	}
};