Function isURL

src/lib/isURL.js:56–267

(url, options)

const wrapped_ipv6 = /^\[([^\]]+)\](?::([0-9]+))?$/;

export default function isURL(url, options) {
  assertString(url);
  if (!url || /[\s<>]/.test(url)) {
    return false;
  }
  if (url.indexOf('mailto:') === 0) {
    return false;
  }
  options = merge(options, default_url_options);

  if (options.validate_length && url.length > options.max_allowed_length) {
    return false;
  }

  if (!options.allow_fragments && includes(url, '#')) {
    return false;
  }

  if (!options.allow_query_components && (includes(url, '?') || includes(url, '&'))) {
    return false;
  }

  let protocol, auth, host, hostname, port, port_str, split, ipv6;

  split = url.split('#');
  url = split.shift();

  split = url.split('?');
  url = split.shift();

  // Replaced the 'split("://")' logic with a regex to match the protocol.
  // This correctly identifies schemes like `javascript:` which don't use `//`.
  // However, we need to be careful not to confuse authentication credentials (user:password@host)
  // with protocols. A colon before an @ symbol might be part of auth, not a protocol separator.
  const protocol_match = url.match(/^([a-z][a-z0-9+\-.]*):/i);
  let had_explicit_protocol = false;

  const cleanUpProtocol = (potential_protocol) => {
    had_explicit_protocol = true;
    protocol = potential_protocol.toLowerCase();

    if (options.require_valid_protocol && options.protocols.indexOf(protocol) === -1) {
      // The identified protocol is not in the allowed list.
      return false;
    }

    // Remove the protocol from the URL string.
    return url.substring(protocol_match[0].length);
  };

  if (protocol_match) {
    const potential_protocol = protocol_match[1];
    const after_colon = url.substring(protocol_match[0].length);

    // Check if what follows looks like authentication credentials (user:password@host)
    // rather than a protocol. This happens when:
    // 1. There's no `//` after the colon (protocols like `http://` have this)
    // 2. There's an `@` symbol before any `/`