Returns true only when url resolves (against baseOrigin) to an http: or https: URL and
is not a scheme-relative //host/... reference. Used across all surface sinks (RenderUrl,
TracksFor, SafeUrl, OpenInNew, Download) so neither model-supplied URLs nor rehydrated
session URLs can inject javascript:, data:, blob:, or scheme-relative targets.
Returns true only when
urlresolves (againstbaseOrigin) to anhttp:orhttps:URL and is not a scheme-relative//host/...reference. Used across all surface sinks (RenderUrl,TracksFor,SafeUrl,OpenInNew,Download) so neither model-supplied URLs nor rehydrated session URLs can injectjavascript:,data:,blob:, or scheme-relative targets.