Repository navigation
Add 'tel:' to sanitizer acceptable protocols? #138
Description
Most (if not all) mobile browsers can hyperlink telephone numbers, like so:
`0123456789``
When tapped / clicked, these numbers will open in the phone's dialler. Any objections to adding 'tel' to the list of acceptable_protocols in sanitizer.py?
Activity
willkg commentedon Oct 3, 2017
I just closed the relevant PR.
First, someone needs to research whether
tel:is safe in all contexts. We'd want that for this to be added as a default. I think the answer is "no" based on this comment:#149 (comment)
Though that's conflating "valid" with "safe" a bit.
I don't think this is a good thing to have as a default. Given that, I'm going to close this out.
If someone can prove it's safe in all contexts, I'm game for re-opening and discussing it further.
gsnedders commentedon Oct 5, 2017
I'm pretty sure it is safe with the possible proviso of very old Android WebView, but I never sat down and figured this out. Validity is irrelevant for the sanitiser; we allow tons of invalid stuff.