Function is_safe_hyperlink 

pub fn is_safe_hyperlink(uri: &str) -> bool

Whether a hyperlink destination may be rendered as a live link.

The scheme is read the way browsers do: control characters and spaces ahead of it are ignored and tabs / newlines are removed anywhere, so " java\nscript:alert(1)" is javascript:. A destination without a scheme is a relative reference, and a one-letter scheme is a Windows drive (C:\…) — both are safe.