Refactor security against dangerous URL

[blackfalcon]

General Support Request

Refactor the code to be more security robust.

auro-hyperlink/src/component-base.mjs

Lines 90 to 123 in dff0c54

	safeUrl(href, relative) {
	if (href !== undefined) {
	const url = new URL(href, 'https://www.alaskaair.com');
	switch (url.protocol) {
	case 'javascript:': // eslint-disable-line
	return '';
	case 'tel:':
	return href;
	case 'sms:':
	return href;
	case 'mailto:':
	return href;
	default:
	if (!relative) {
	url.protocol = 'https:';
	return url.href;
	} else if (relative) {
	return href;
	}
	}
	} else if (href === undefined) {
	return undefined;
	}
	return undefined;
	}

Possible Solution

Remove unwanted references and be specific about types that are secure and supported. The updated code should still disallow any HREFs that are JavaScript as well ignore data: type URLs and anything else that is not explicitly supported.

Additional context

Code was reviewed in a security training session and it was pointed out that there were subtle flaws regarding allowing JavaScript to be recognized as a type and then having to return an empty string. The suggestion was to simply not even list options are not allowed, but to only allow options that are considered safe.

It was pointed out that we were not accounting for the href data: type.

Exit criteria

This issue can be closed once the updates made improve on the previous security model, maintain the exclusion of JavaScript protocol and will also account the long list of other protocols that are unsupported.