Does URL.canParse confirm that a cleaned link is an allowed web URL?

Measured inputs and outputs

These are locally constructed test strings, not evidence that Claude inserts these characters. We executed the saved homepage script snapshot with a minimal DOM harness and compared exact strings. The invisible-checkbox state and dash mode appear in each row. The observations below test this page's specific question. Destination observations run independently on the exact input and cleaned strings in the recorded Node runtime. We make no detector-score or statistical-watermark removal claim.

Syntactic acceptance includes more than web navigation links

We invoke URL.canParse and URL.parse without a base. The marked HTTPS fixture initially has no recognized valid absolute scheme, so canParse is false and parse returns null. Removing the selected marker repairs it to the HTTPS control, which both functions accept. The data and mailto controls are accepted as well, yet their protocols are data: and mailto:, and the hostname fields are empty in these particular examples. Our allowedHttp expression permits only http: or https:, therefore returning false for both. The comparison demonstrates an explicit policy decision after successful parsing rather than assuming that a true parser result implies a usable HTTPS link.

The example allowlist does not establish endpoint trust

No URL in this test is fetched, opened or sent to a remote service. The example.test hostname is a fixture, not evidence of an available website. Even the accepted HTTPS control has only passed syntax and this narrow protocol policy. We do not resolve DNS, examine redirects, check a certificate, classify an address, or implement a complete fetch policy. The earlier scheme-fallback guide supplies a base and measures relative resolution; this test supplies none and uses a nullable parsing interface. Its invalid first row therefore does not contradict acceptance under an explicit base. Runtime support for the two static methods is recorded by the reproducer’s Node version.

Name the validation result according to what it measured

Keep parser failure separate from a policy rejection so an interface can explain whether the spelling is malformed or the supported link type differs. Review the protocol after the intended cleanup because the repaired fixture changes its parser outcome. Add the receiving application’s further requirements where appropriate and test them independently; a boolean named valid can obscure which requirements actually ran. The harness uses inert strings and retains the parsed fields alongside both boolean results. It does not infer a link’s safety, ownership, availability or content from a removal count. These controls answer the narrow question of why a successfully parsed value may still fail a declared HTTP-only input contract.

Reproduce this test

Save reproduce.cjs and tested-app.js in the same folder. Run the command below with Node.js. The harness prints its runtime, script SHA-256 and every measured row. Compare those rows with the original record. Using a newer script or runtime creates a new experiment; retain the version information with your rerun.

node reproduce.cjs