safeBrandUrlOrNull

Whether url is safe to fetch or open from event metadata: an absolute https URL whose authority is a valid host with an optional numeric port.

The manifest is first-party but arrives over the network, and its URLs reach an image loader and the platform URI handler. A URI handler will honour whatever scheme it is given, so without this check a bad or tampered manifest entry could invoke arbitrary handlers on the device. Scheme comparison is case-insensitive; everything else is rejected, including protocol-relative (//host) and scheme-relative input.

The authority is matched whole rather than merely tested for emptiness, so a port with no host (https://:443), whitespace, a truncated IPv6 literal, and userinfo (https://trusted.host@evil.example, which wears a trusted prefix) are all rejected — none of those characters appear in the permitted set.