Add 'tel:' to sanitizer acceptable protocols?

[igloox]

Most (if not all) mobile browsers can hyperlink telephone numbers, like so:

`0123456789``

When tapped / clicked, these numbers will open in the phone's dialler. Any objections to adding 'tel' to the list of acceptable_protocols in sanitizer.py?

[willkg]

I just closed the relevant PR.

First, someone needs to research whether tel: is safe in all contexts. We'd want that for this to be added as a default. I think the answer is "no" based on this comment:

#149 (comment)

Though that's conflating "valid" with "safe" a bit.

I don't think this is a good thing to have as a default. Given that, I'm going to close this out.

If someone can prove it's safe in all contexts, I'm game for re-opening and discussing it further.

[gsnedders]

I'm pretty sure it is safe with the possible proviso of very old Android WebView, but I never sat down and figured this out. Validity is irrelevant for the sanitiser; we allow tons of invalid stuff.