var validateWebcamUrl = function (streamUrl) {
    if (!streamUrl) {
        return false;
    }

    var lower = streamUrl.toLowerCase();
    var toParse = streamUrl;

    if (lower.startsWith("//")) {
        // protocol relative
        toParse = window.location.protocol + streamUrl;
    } else if (lower.startsWith("/")) {
        // host relative
        toParse = getExternalHostUrl() + streamUrl;
    } else if (
        lower.startsWith("http:") ||
        lower.startsWith("https:") ||
        lower.startsWith("webrtc:")
    ) {
        // absolute & http/https/webrtc
        toParse = streamUrl;
    } else {
        return false;
    }

    try {
        return new URL(toParse);
    } catch (e) {
        return false;
    }
};
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.