var isReturnUrlAllowed = false

for (var i = 0; i < this.config.allowedReturnUrlPatterns.length; i++) {

var allowedReturnUrlPattern = new RegExp(this.config.allowedReturnUrlPatterns[i])

if (allowedReturnUrlPattern.test(returnUrl)) {

isReturnUrlAllowed = true

break

}

}

if (!isReturnUrlAllowed) {

**Type:** Array

**Default:** `['^https?://']`

**Description:** Define the string representations of the regular expressions that will be allowed for the `return_url` query parameter.

If the value of the `return_url` query parameter does not match any regular expression derived from the string representation of each of the elements of this array, navigation to it will be blocked.

} catch {}

} catch {}

} catch {}

clearContext: true,

allowedReturnUrlPatterns: ['^https?://']

var isReturnUrlAllowed = false

for (var i = 0; i < this.config.allowedReturnUrlPatterns.length; i++) {

var allowedReturnUrlPattern = new RegExp(this.config.allowedReturnUrlPatterns[i])

if (allowedReturnUrlPattern.test(returnUrl)) {

isReturnUrlAllowed = true

break

}

}

if (!isReturnUrlAllowed) {

it('should navigate the client to return_url if specified and allowed', function (done) {

var config = {

// The default value.

allowedReturnUrlPatterns: ['^https?://']

}

socket.emit('execute', config)

it('should not navigate the client to return_url if not allowed', function () {

var config = {

allowedReturnUrlPatterns: []

}

windowLocation.search = '?id=567&return_url=javascript:alert(document.domain)'

socket = new MockSocket()

k = new ClientKarma(updater, socket, iframe, windowStub, windowNavigator, windowLocation)

clientWindow = { karma: k }

ck = new ContextKarma(ContextKarma.getDirectCallParentKarmaMethod(clientWindow))

socket.emit('execute', config)

try {

ck.complete()

throw new Error('An error should have been caught.')

} catch (error) {

assert(/Error: Security: Navigation to .* was blocked to prevent malicious exploits./.test(error))

}

})