Function is_safe_registry_url 

pub fn is_safe_registry_url(url: &str) -> bool

Whether url is safe to embed as a Swift Package Manager repository URL in a Package.swift [TextEdit] or completion item.

Guards Swift’s URL-completion producer, which builds a .package(url: "...") string-literal replacement from a package registry search result’s URL — a value type distinct from a version string (see is_safe_version_string’s doc comment for why version-derived and non-version-derived sinks each get their own allowlist).

An allowlist, not a denylist: url must be non-empty, at most 2048 bytes, start with https:// — every real Swift package registry response is HTTPS (GitHub’s html_url never downgrades), so accepting plain http:// would only hand a compromised/malicious registry a transport-downgrade lever for zero legitimate benefit — and otherwise contain only RFC 3986 URL characters (A-Za-z0-9 plus -._~:/?#[]@!$&'()*+,;=%). Deliberately excludes ", \, control characters, and whitespace — none of those are valid unencoded URL characters, and any of them could close the surrounding Swift string literal or otherwise corrupt the manifest. Failing closed on an unrecognized character keeps a malicious/compromised search result from breaking out of the string it’s inserted into.

Examples

use deps_core::is_safe_registry_url;

assert!(is_safe_registry_url("https://github.com/apple/swift-nio"));
assert!(!is_safe_registry_url("https://evil.example\", .exact(\"1\")) // "));