Only allow https, and http if not on https

instantpage.js

@@ -103,6 +103,10 @@ function isPreloadable(linkElement) {
     return
   }
 
+  if (urlObject.protocol != 'https:' || (urlObject.protocol == 'http:' && location.protocol == 'https:')) {
+    return
+  }
+
   if (!allowQueryString && urlObject.search && !('instant' in linkElement.dataset)) {
     return
   }

test/app.js

@@ -79,6 +79,7 @@ async function requestListener(req, res) {
     content += `<a href="/${page}?${Math.random()}" data-no-instant><span>Manually blacklisted link</span></a>`
     content += `<a href="https://www.google.com/" ${dataInstantAttribute}><span>External link</span></a>`
     content += `<a><span>&lt;a&gt; without <code>href</code></span></a>`
+    content += `<a href="file:///C:/"><span>file: link</span></a>`
 
     let footer = await fsPromises.readFile(path.resolve(__dirname, 'footer.html'))
     footer = footer.toString().replace('__HASH__', jsHash)