Repository: rust-lang/rust
File: src/librustdoc/html/format.rs (Rust)

Code before:
            // as long as we can link to the item the impl is on.
            // since associated traits are not a thing,
            // it should not be possible to refer to an impl item if
            // the base type is not namable.
            DefKind::Impl { .. } => return false,
            // everything else does not have docs generated for it
            _ => return true,
        }
    }
    return false;
}

fn to_module_fqp(shortty: ItemType, fqp: &[Symbol]) -> &[Symbol] {
    if shortty == ItemType::Module { fqp } else { &fqp[..fqp.len() - 1] }
}

fn url_parts(
    cache: &Cache,
    def_id: DefId,
    module_fqp: &[Symbol],
    relative_to: &[Symbol],
    is_remote: &mut bool,
) -> Result<UrlPartsBuilder, HrefError> {
    match cache.extern_locations[&def_id.krate] {
        ExternalLocation::Remote(ref s) => {
            let is_abs = s.contains("://") || s.starts_with('/');
            *is_remote = is_abs;
            let s = s.trim_end_matches('/');
            let mut builder = if is_abs {
                UrlPartsBuilder::singleton(s)
            } else {
                // Relative paths are authored to work from the crate root
                // directory (depth 1). For deeper pages we need extra `../`
                // segments so the link still resolves to the same target
                let extra = relative_to.len().saturating_sub(1);
                let mut b: UrlPartsBuilder = iter::repeat_n("..", extra).collect();
                b.push(s);
                b
            };
            builder.extend(module_fqp.iter().copied());
            Ok(builder)
        }
        ExternalLocation::Local => Ok(href_relative_parts(module_fqp, relative_to)),
        ExternalLocation::Unknown => Err(HrefError::DocumentationNotBuilt),
    }
}

fn make_href(
    root_path: Option<&str>,
    shortty: ItemType,
    mut url_parts: UrlPartsBuilder,

Review comment (security):
There's actually the (uncommon) possibilities that someone specifies a network-path reference URI (which would begin `//` without the `scheme:` prefix); or a relative-path reference that happens to include `://` somewhere within the path (for example `../this_is_silly://but_perfectly_valid`).

Perhaps instead use a regex, such as that from [Appendix B of RFC 3986](https://www.rfc-editor.org/rfc/rfc3986#appendix-B), and treat the URI as absolute if (i) either of the scheme or authority components are present; or (ii) the path component begins with `/`.

Moreover, that's a check we only need to perform once when creating the `ExternalLocation::Remote`—so perhaps move it into an `is_absolute` boolean of the variant and avoid recomputing it every time we create a URL for that crate?

Code after:
            // items in impls can be linked to,
            // as long as we can link to the item the impl is on.
            // since associated traits are not a thing,
            // it should not be possible to refer to an impl item if
            // the base type is not namable.
            DefKind::Impl { .. } => return false,
            // everything else does not have docs generated for it
            _ => return true,
        }
    }
    return false;
}

fn to_module_fqp(shortty: ItemType, fqp: &[Symbol]) -> &[Symbol] {
    if shortty == ItemType::Module { fqp } else { &fqp[..fqp.len() - 1] }
}

fn remote_url_prefix(url: &str, is_absolute: bool, depth: usize) -> UrlPartsBuilder {
    let url = url.trim_end_matches('/');
    if is_absolute {
        UrlPartsBuilder::singleton(url)
    } else {
        let extra = depth.saturating_sub(1);
        let mut b: UrlPartsBuilder = iter::repeat_n("..", extra).collect();
        b.push(url);
        b
    }
}

fn url_parts(
    cache: &Cache,
    def_id: DefId,
    module_fqp: &[Symbol],
    relative_to: &[Symbol],
    is_absolute: &mut bool,
) -> Result<UrlPartsBuilder, HrefError> {
    match cache.extern_locations[&def_id.krate] {
        ExternalLocation::Remote { ref url, is_absolute: abs } => {
            *is_absolute = abs;
            let mut builder = remote_url_prefix(url, abs, relative_to.len());
            builder.extend(module_fqp.iter().copied());
            Ok(builder)
        }
        ExternalLocation::Local => Ok(href_relative_parts(module_fqp, relative_to)),
        ExternalLocation::Unknown => Err(HrefError::DocumentationNotBuilt),
    }
}

fn make_href(
    root_path: Option<&str>,
    shortty: ItemType,