A cross-site scripting issue exists in phoenix live view due to improper URL scheme validation. The functions `valid destination!/2` and `valid live navigation destination!/2` use an internal `uri scheme/1` helper that fails to detect schemes if the input begins with a space or an ASCII control character. Because standard browsers strip these leading characters before parsing, an attacker can provide a payload like " javascript:alert(1)" that bypasses validation and is treated as a safe relative path. When rendered via `<.link href={...}>`, the browser executes the script in the victim's session. This affects applications that render user-supplied URLs, such as redirect targets or profile links.