Allow http

[JoannaaKL]

Also allow http links in sanitisation filter.

[Copilot]

Pull Request Overview

This PR modifies the HTML sanitization policy to allow both HTTP and HTTPS URL schemes in links, where previously only HTTPS was permitted.

• Expands allowed URL schemes from HTTPS-only to include both HTTP and HTTPS protocols

Comments suppressed due to low confidence (2)

pkg/sanitize/sanitize.go:57

• Allowing 'http' URLs introduces a security concern. HTTP traffic is unencrypted and susceptible to man-in-the-middle attacks, which could expose users to malicious content. The policy already uses RequireNoFollowOnLinks(true) and RequireNoReferrerOnLinks(true), but these don't protect against eavesdropping or tampering with HTTP links. Consider whether HTTP URLs are truly necessary, or if the policy should continue enforcing HTTPS-only to ensure secure connections.

		if toggled {

pkg/sanitize/sanitize.go:57

• The change to allow 'http' URLs lacks test coverage. The existing test suite only includes an HTTPS URL test case (line 223-224 in sanitize_test.go). Add test cases to verify that HTTP URLs are properly allowed and sanitized, for example: a test with <a href=\"http://example.com\">link</a> to confirm the new behavior.

		if toggled {

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.