[feature] allow notes:// and file:// protocols

[epinault]

Would it be possible to make a prune of the attributes to support custom protocols? Currently it is removes the href attribute if not a known (whitelist) protocol. something that would allow to support extra custom protocols as a list maybe?

[flavorjones]

Are there protocols besides FTP, HTTP, HTTPS, mailto, tel. callto, cid, or xmpp that you'd like to use?

If that's a superset of what you like then #155 should address. If not, please let me know what other protocols you have in mind -- I'd love to understand better what you're intending to do.

[flavorjones]

Note we'll be adding tel and line support in v2.3.0. Not sure if that's helpful.

[fmarkovic]

Could file:// and notes:// protocols be implemented? We need it for users that have those legacy protocols.

[flavorjones]

@fmarkovic Can you help me understand the impact of these changes? What is notes://? It looks like it might be related to Lotus Notes? Which seems like it's probably OK to add.

file:// is a little dicier, since it's accessing the local filesystem. Can you help me understand your use case?

I'd like to also suggest that you can customize your application's behavior by adding to Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS, e.g.:

Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS.add("xxxxxxxxx")

[fmarkovic]

Rails' SafeListSanitizer strips whole hrefs from valid user data entered as links in CK editor. Cases that our users expect are file:// (admin and user are on the same network in the company) and Lotus Notes protocol.

[fmarkovic]

Where in the application does it make sense to make this change Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS.add("xxxxxxxxx") in your opinion?

[flavorjones]

@fmarkovic I'm not an expert, but I would do it in a Rails initializer, so it happens once at application startup.

It might be worth opening an issue with https://github.com/rails/rails-html-sanitizer to ask about the ability to customize protocols using that gem -- it already allows some other common customizations.

[fmarkovic]

@flavorjones Using Loofah::HTML5::SafeList::ALLOWED_PROTOCOLS.add("xxxxxxxxx") in initializers seems to cover our use case. Rails Html Sanitizer (version that we are using) does not have any direct way of interfacing with ALLOWED_PROTOCOLS, I've looked at the code directly. I will raise an issue there, probably. Thank you for your support 👍