Symfony version(s) affected

6.2.2

Description

Html Sanitizer has hard-coded default collection of protocols allowed in <a href="url"> in HtmlSanitizerConfig:

    private ?array $allowedLinkSchemes = ['http', 'https', 'mailto', 'tel'];

There is a method HtmlSanitizerConfig::allowLinkSchemes() allowing to override it with custom list of allowed protocols. However, there is no way to just allow any protocol: to remove any restrictions from the URL's protocol.

This is already supported by UrlSanitizer::sanitize() but there is no way to pass null to $allowedSchemes which would remove any protocol related restrictions.

How to reproduce

<?php

namespace App\Command;

use Symfony\Component\Console\Attribute\AsCommand;
use Symfony\Component\Console\Command\Command;
use Symfony\Component\Console\Input\InputInterface;
use Symfony\Component\Console\Output\OutputInterface;
use Symfony\Component\HtmlSanitizer\HtmlSanitizer;
use Symfony\Component\HtmlSanitizer\HtmlSanitizerConfig;

#[AsCommand(name: 'example')]
class ExampleCommand extends Command
{
    protected function execute(InputInterface $input, OutputInterface $output): int
    {
        $customConfig = (new HtmlSanitizerConfig)
            ->allowElement('a', '*')
            ->allowLinkSchemes([]) // null would work but it's impossible because of typing; I don't want to hardcode any protocol here
        ;
        $sanitizer = new HtmlSanitizer($customConfig);

        $output =  $sanitizer->sanitize('<a href="news://somedomain.com">some text</a>');

        dd($output);
       // outputs: <a>some text</a>
    }
}

Possible Solutions

• Allow null in HtmlSanitizerConfig::allowLinkSchemes() and related fields & getters.
• Reorganize configuration to make it possible in more elegant way, maybe create new allowAllLinkSchemes() method.

Additional Context

This may need to be handled also in framework bundle: currently empty value (null, empty array) of framework.html_sanitizer.sanitizers.XXXX.allowed_link_schemes causes HtmlSanitizerConfig::allowLinkSchemes() to not be called at all.