diff --git a/lib/classes/param.php b/lib/classes/param.php
index 32818dbb915..96c6eaf9fe2 100644
--- a/lib/classes/param.php
+++ b/lib/classes/param.php
@@ -1067,8 +1067,10 @@ enum param: string {
                 // Absolute, and matches our wwwroot.
             } else {
                 // Relative - let's make sure there are no tricks.
-                if (validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
-                        !preg_match('/javascript(?:.*\/{2,})?:/i', rawurldecode($param))) {
+                if (
+                    validateUrlSyntax('/' . $param, 's-u-P-a-p-f+q?r?') &&
+                    !preg_match('/\bjavascript\b[\s\S]*?(?:\:|\/)/i', rawurldecode($param))
+                ) {
                     // Valid relative local URL.
                 } else {
                     $param = '';