tweak sanitizeUrl() (#1703)

* tweak sanitizeUrl()

* add test

src/@utils/url.test.ts

@@ -0,0 +1,9 @@
+import { sanitizeUrl } from './url'
+
+describe('@utils/url', () => {
+  test('sanitizeUrl', () => {
+    expect(sanitizeUrl('http://example.com')).toBe('http://example.com')
+    expect(sanitizeUrl('https://example.com')).toBe('https://example.com')
+    expect(sanitizeUrl('ftp://example.com')).toBe('about:blank')
+  })
+})

src/@utils/url.ts

@@ -1,10 +1,5 @@
 export function sanitizeUrl(url: string) {
   const u = decodeURI(url).trim().toLowerCase()
-  if (
-    u.startsWith('javascript:') ||
-    u.startsWith('data:') ||
-    u.startsWith('vbscript:')
-  )
-    return 'about:blank'
-  return url
+  const isAllowedUrlScheme = u.startsWith('http://') || u.startsWith('https://')
+  return isAllowedUrlScheme ? url : 'about:blank'
 }