title: sanitizing untrusted url strings that will be passed to location.replace
body: <p>I'm getting a string from the current window's fragment identifier (<code>location.hash</code>).  I want to use that string as the argument to <code>location.replace(str)</code>.</p>
  
  <p>Under normal circumstances, the string will come from code I control, so I'm not worried about validating that the string is a URL.  If the string isn't a URL, the call to replace will just fail.  That's fine.</p>
  
  <p>What I am concerned about is making sure the string is NOT a <code>javascript:</code> URL or anything else that would allow someone to run arbitrary Javascript on my domain.  Currently, I'm just checking that that <code>str.indexOf('http') == 0</code>.  </p>
  
  <p>Is that enough or should I sanitize this string some more?</p>