On: If your code accepts URIs as input, filter out “fi...

[vetinari]

Also file:// urls pointing to server shares.

(Anyway, only MSIE supports this from http(s) origin, and then people wonder, why MSIE is still being used).