Skip to main content

function-url-scheme-disallowed-list

Specify a list of disallowed URL schemes.

a { background-image: url('http://www.example.com/file.jpg'); }
/**                        ↑
 *           This URL scheme */

A URL scheme consists of alphanumeric, +, -, and . characters. It can appear at the start of a URL and is followed by :.

This rule ignores:

  • URL arguments without an existing URL scheme
  • URL arguments with variables or variable interpolation ($sass, @less, --custom-property, #{$var}, @{var}, $(var))

The message secondary option can accept the arguments of this rule.

Options​

array|string|regex: ["array", "of", /schemes/, "/regex/"]|"scheme"|"/regex/"|/regex/

Given:

["ftp", "/^http/"]

The following patterns are considered problems:

a { background-image: url('ftp://www.example.com/file.jpg'); }
a { background-image: url('http://www.example.com/file.jpg'); }
a { background-image: url('https://www.example.com/file.jpg'); }

The following patterns are not considered problems:

a { background-image: url('data:image/gif;base64,R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs='); }
a { background-image: url('example.com/file.jpg'); }
a { background-image: url('/example.com/file.jpg'); }
a { background-image: url('//example.com/file.jpg'); }
a { background-image: url('./path/to/file.jpg'); }