function validateLink(url) {
  // url should be normalized at this point, and existing entities are decoded

  var str      = url.trim().toLowerCase(),
      protocol = str.split(':')[0];

  if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(protocol) >= 0) {
    if (protocol === 'data' && ALLOWED_DATA_MIMES.indexOf(str.split(';')[0]) >= 0) {
      return true;
    }
    return false;
  }

  return true;
}
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.