What does an unsafe URL value in a description attribute mean?
HTML elements can use attributes such as href or src to specify a destination. Some address forms do not behave like ordinary web links; for example, MDN discourages the javascript: scheme because navigation can execute JavaScript. The detector flags forms classified as unsafe by the PROVEN rule in the description context.
The finding does not say that every external link is dangerous and does not prove that a shopper activated the address. It may be an old snippet, imported value, or function that no longer belongs in the description. The intended destination must be verified before removal or replacement.
Examples of URL attributes that require context
These fictional examples use simplified values. The PROVEN check defines the flagged forms; this page is not an exhaustive allowlist or denylist of URI schemes.
<a href="javascript:…">Action</a>[scheme capable of executing JavaScript]MDN discourages javascript: URLs; the finding preserves the attribute without assuming a user activated it.
A product link still points to a destination inherited from another storeVerify that the URL is current and intentionalA wrong destination is not the same as an unsafe one, but merchant context determines the right remediation.
Imported markup attaches an unusual scheme to an elementCompare intended function with supported alternativesDo not invent a destination merely to clear the finding.
What does PROVEN check?
Checks addresses attached to description elements that use forms considered unsafe.
Why does it matter?
An unsafe address can turn a content element into a source of unintended behavior.
Why inspect the address instead of only the link text?
Link text can look normal while behavior is determined by the attribute value. MDN explains that javascript: URLs are navigation targets capable of executing code and discourages them; restrictive CSP also treats this form as inline JavaScript.
For the merchant, correct remediation means a verified HTTPS or internal destination, or removing the link when it serves no purpose. PROVEN does not guess the correct URL and does not claim the finding proves an attack.
What can PROVEN do?
PROVEN can prepare controlled removal of the problematic address; the change requires your review.
How PROVEN handles a flagged URL attribute
The flow keeps the observed value, navigation intent, and replacement destination separate.
- Show the element, attribute, and valuePROVEN locates the address matching the check criteria and preserves it as evidence.
- Verify the intended destinationThe merchant determines whether the element should navigate, load a resource, or be removed entirely.
- Prepare replacement or removalPROVEN can propose a change only when a verified destination or clear removal decision exists; the merchant confirms the result.
Why can’t PROVEN invent a “safe” address?
A finding identifies a problematic URL form but does not automatically contain the correct commercial destination. Replacing it with an assumed URL can send shoppers to the wrong page.
Check product source data, intended navigation, and theme behavior. The URL’s presence does not prove execution, attack, or compromise.
What this page does not tell you
- The detector does not classify every external link as unsafe.
- The finding does not prove a shopper activated the address or that code executed.
- The presence of a flagged URL form does not prove attack or store compromise.
- PROVEN does not invent the correct destination for a commercial link.
- CSP and platform sanitization are controls separate from this check.
Frequently asked questions
What is a javascript: URL?
MDN describes it as a URL scheme that can execute JavaScript when the browser navigates to it and recommends avoiding the practice.
Is every unusual URL malicious?
No. The detector applies its own classification and context must be reviewed; an unusual form is not evidence of malicious intent.
Can PROVEN automatically replace it with https://?
Not without a factual destination. Changing the scheme does not guarantee that the resulting URL is correct for the product.
Does CSP solve the issue?
CSP can restrict javascript: and other inline forms, but browser enforcement does not replace clean catalog data.
Sources and independent context
The sources below explain the relevant platform or web standards. They provide context for interpretation but do not by themselves show that your store has this finding.
- MDN — javascript: URLsMDN explains that javascript: URLs execute JavaScript as navigation targets and discourages their use.
- MDN — Content Security PolicyMDN documents that restrictive policies block inline JavaScript forms including javascript: URLs.
- Shopify — Using the rich text editorShopify documents links in rich text and HTML sanitization intended to prevent problems.