Skip to content

Add 'tel:' to sanitizer acceptable protocols? #138

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
igloox opened this issue Jan 5, 2014 · 2 comments
Open

Add 'tel:' to sanitizer acceptable protocols? #138

igloox opened this issue Jan 5, 2014 · 2 comments
Labels
question sanitizer

Comments

@igloox
Copy link

igloox commented Jan 5, 2014

Most (if not all) mobile browsers can hyperlink telephone numbers, like so:

`0123456789``

When tapped / clicked, these numbers will open in the phone's dialler. Any objections to adding 'tel' to the list of acceptable_protocols in sanitizer.py?
@igloox igloox mentioned this issue Apr 30, 2014
Closed
@willkg
Copy link
Contributor

willkg commented Oct 3, 2017

I just closed the relevant PR.

First, someone needs to research whether tel: is safe in all contexts. We'd want that for this to be added as a default. I think the answer is "no" based on this comment:

#149 (comment)

Though that's conflating "valid" with "safe" a bit.

I don't think this is a good thing to have as a default. Given that, I'm going to close this out.

If someone can prove it's safe in all contexts, I'm game for re-opening and discussing it further.

@willkg willkg closed this as completed Oct 3, 2017
@gsnedders
Copy link
Member

I'm pretty sure it is safe with the possible proviso of very old Android WebView, but I never sat down and figured this out. Validity is irrelevant for the sanitiser; we allow tons of invalid stuff.

@gsnedders gsnedders reopened this Oct 5, 2017
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
question sanitizer
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gsnedders @igloox @willkg