pub fn safe_link(raw: &str) -> Option<String>Expand description
Scheme-allow-list a URL destined to be rendered as an href (an entry’s
“View original” link, a feed’s site link). Accepts only http/https;
anything else (notably javascript: / data: — stored-XSS vectors that
survive HTML escaping) yields None so the caller drops the link.