Skip to main content

Function: validateExternalUrl()

function validateExternalUrl(url: unknown): string;

Defined in: shared/externalUrlPolicy.ts:18

Validate a URL intended for shell.openExternal.

Security properties:

  • Only allow https and mailto protocols.
  • Reject embedded credentials.
  • Reject non-string, empty, or malformed inputs.

Behavioral property:

  • Returns the caller-provided URL string trimmed, not canonicalized, to avoid surprise changes like appending a trailing slash.

Parameters​

url​

unknown

Returns​

string

Throws​

TypeError when the input is not a valid URL string.

Throws​

Error when the URL protocol or credential policy rejects the URL.