<a> tag contextual link broken

Checked the URL and replaced with # if not the valid URL. The issue needs review.

This solution does not allow relative URLs such as /video/external/youtube. Does this work for you, @norman.lol?

Thank you for your contribution @chhavi 🤗 but @jan is right: We need to take both absolute and relative URLs into account.

Maybe we could check first, if the string starts with a / character and if yes, temporarily prefix it with https://www.example.com to still be able to use this nice and clean URL method of the current MR. 🤔

Ah, you can simply pass context.location.origin to the URL constructor, to make it also work for relative or even protocol-relative URLs like //example.com/foobar, see https://developer.mozilla.org/en-US/docs/Web/API/URL/URL.

But there's another problem: data-href="javascript:alert()" is recognised as a valid URL. And this is exactly what we want to avoid.

Yes, Norman, as you suggested, we should check the protocol:

url.protocol === 'http:' || url.protocol === 'https:'

@norman.lol @jan Did the sugested changes to support relative URLs. Please review.

IMHO it doesnt realy make sense to to add contextual consent for outgoing links, for OP´s example

  <a data-name="chatbot" data-href="https://example.com/live-chat-url">
    Chat with Support
  </a>

Consent would have to be obtained on example.com, as clicking a link will not load something into the current page/host.

For relative links on the same host it doesnt really make sense to me either.

+ in the klaro-js upstream lib it was more or less a bug that anchor tags are also handled
But maybe i am overseeing something here.