How to get tel: links to not be removed?

[clarencefoy]

I have tried:

bMN.AllowStandardURLs()
bMN.AllowAttrs("href").OnElements("a")
bMN.AllowAttrs("href").Matching(regexp.MustCompile(`tel:`)).OnElements("a")

But to no avail. If someone submits a link that's simply "tel:123456", how to make sure the href attribute does not get deleted?

Many thanks

[Dee]

https://go.dev/play/p/Z2PWy4-1rQx

package main

import (
	"fmt"

	"github.com/microcosm-cc/bluemonday"
)

func main() {
	// Do this once for each unique policy, and use the policy for the life of the program
	// Policy creation/editing is not safe to use in multiple goroutines
	p := bluemonday.UGCPolicy()
	p.AllowURLSchemes(`tel`)

	// The policy can then be used to sanitize lots of input and it is safe to use the policy in multiple goroutines
	html := p.Sanitize(
		`<a href="tel:[phone]">Call me</a> or <a href="https//example.org">Check my website</a>`,
	)

	// Output:
	// <a href="tel:[phone]" rel="nofollow">Call me</a> or <a href="https//example.org" rel="nofollow">Check my website</a>
	fmt.Println(html)
}

[Dee]

Ultimately the UGCPolicy() is building the allow list, and that is calling a helper called AllowStandardURLs within helpers.go:L128.

The helper itself has this:

// AllowStandardURLs is a convenience function that will enable rel="nofollow"
// on "a", "area" and "link" (if you have allowed those elements) and will
// ensure that the URL values are parseable and either relative or belong to the
// "mailto", "http", or "https" schemes
func (p *Policy) AllowStandardURLs() {
	// URLs must be parseable by net/url.Parse()
	p.RequireParseableURLs(true)

	// !url.IsAbs() is permitted
	p.AllowRelativeURLs(true)

	// Most common URL schemes only
	p.AllowURLSchemes("mailto", "http", "https")

	// For linking elements we will add rel="nofollow" if it does not already exist
	// This applies to "a" "area" "link"
	p.RequireNoFollowOnLinks(true)
}

And it is the AllowURLSchemes that permits the protocol part of a URL.

That func takes a list of schemes, and they are appended to the allow list.

So what was missing was just calling that once more and allowing tel too.