@ericf The scheme "//" shall be handled by the 3rd check; indexOf('/'). By the way, the URI function is meant to be an utility function for dynamically setting user redirection on client or setting and URL to any element attributes (think of href, src etc.). And the schemes like mailto:, ftp:// and file:/// (browser will block file system access) doesn't seem exploitable to me.