It may depend a bit on how you get these 2 lines. Probably a safe, fireproof way to do this is to find it in a URI :: URL or similar library, where all alternatives, including malware, will be considered. It may be slower, but in some environments the speed of a bullet reaching your own leg will be faster.
But if you expect something simple rather than complex, you can see if it starts with /, chains ../ or any other char. The first will put the server name + url, 2 chop paths from the base uri until one of the two alternatives 2 is received, or just add it to the base url.
source share