Linkify should limit its URI schemes to those supported by our HTML msgs

[ara4n]

it's daft to stop someone hyperlinking a file:/// URI in an HTML msg if the first thing we do on displaying the message is to turn the URI back into a hyperlink via linkify. Thanks to @pwn3d:matrix.org for pointing it out

[MurzNN]

I vote to make this configurable! We often send via Riot direct links to internal files like file:///mnt/share/project/file.txt or sftp path to file, and want to open them via single click, instead of manually copy-paste them to file open dialog.

[t3chguy]

@MurzNN that's #4457 (YOUR OWN ISSUE) and is one which is upstream nfrasser/linkifyjs#171

[bardiharborow]

An example where this is particularly nasty is the "hxxp" URL scheme, used to quarantine malicious URLs. Riot relinks them, making them dangerous again.

[besendorf]

Im not sure if this is the right issue to mention this but other links than those starting with http or https are not clickable properly for example atom link dont work.
atom://teletype/portal/xxxxxxx

[t3chguy]

@besendorf the permitted url schemes are https://github.com/matrix-org/matrix-react-sdk/blob/369446a94f77ae81a881fd0aefacb3a35b434e0b/src/HtmlUtils.js#L58

[besendorf]

@t3chguy thanks for the link. That seems quite arbitrary though. Why not allow all url schemes? For example why allow ftp but not sftp?

[t3chguy]

Because nfrasser/linkifyjs#194