Allows "http://www.google" when it shouldn't

The modules allows:

• "http://www.google.com"
• "https://www.google.com"
• "http://google.com"
• "http://www.google.com/imghp"
• "http://g.co"

and disallows:

• "www.google"
• "google"
• "google#.com"
• "google-.co"

The problem is that it ALLOWS http://www.google when it shouldn't.

[simonhaenisch]

Not sure why you consider that an invalid url? Just because it's not (yet) a registered TLD? A user/company might have that domain set up in their local network and then www.google could actually resolve (e. g. to an intranet).

I guess you can use sth like tldExists from tldjs for your use-case.

[crunchiness]

It is actually a registered TLD and used (try https://dns.google/ ), so definitely not a bug.