Bereinigung dynamischer Hyperlinks gegen Skript-Injektion

import { computed } from 'vue';
 
export function useSafeLink(rawUrlRef) {
  const allowedProtocols = new Set(['http:', 'https:', 'mailto:']);
 
  const sanitizedUrl = computed(() => {
    try {
      const parsed = new URL(rawUrlRef.value, window.location.origin);
      return allowedProtocols.has(parsed.protocol) ? parsed.href : '#';
    } catch {
      return '#';
    }
  });
 
  return { sanitizedUrl };
}