function validateLink(url) {
  // url should be normalized at this point, and existing entities are decoded
  //
  var str = url.trim().toLowerCase();

  if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
    return false;
  }
  return true;
}
The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.