Add tel: as href support

[ValeryVerkhoturov]

Initial checklist

• I read the support docs
• I read the contributing guide
• I agree to follow the code of conduct
• I searched issues and discussions and couldn’t find anything or linked relevant results below
• I made sure the docs are up to date
• I included tests (or that’s not needed)

Description of changes

Add support tel as href:

<Markdown children="[](tel:+12345678910)" />

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (2245c64) to head (89ab21e).
Report is 46 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##              main      #904    +/-   ##
==========================================
  Coverage   100.00%   100.00%            
==========================================
  Files            3         3            
  Lines         1354      1746   +392     
  Branches       113       124    +11     
==========================================
+ Hits          1354      1746   +392     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ChristianMurphy]

Tel is intentionally not supported #865, #829, and #655 (comment), but can be added through an option

[JounQin]

https://spec.commonmark.org/0.22/#scheme

@ChristianMurphy It seems there are a lot of protocols supported in commonmark spec.

Oh, sorry, the latest version is https://spec.commonmark.org/0.31.2/#scheme

[ChristianMurphy]

There are a lot that are parsed, but they are intentionally filtered out to make renders safe, for example GFM e.g. <tel:+12345678910> renders as tel:+12345678910

[JounQin]

@ChristianMurphy Thanks for clarification, just found the related commit 08ead9e

But it lacks explanation why it's removed and considered as unsafe, and why gfm is considered.

[wooorm]

The default is what GH does (not particularly GFM, that’s only a part of everything that GH does). GH has a small allow list. That small list is safe. We follow GH in many cases.

You can configure things: see the readme: pass a urlTransform option!

[JounQin]

The default is what GH does (not particularly GFM, that’s only a part of everything that GH does). GH has a small allow list. That small list is safe. We follow GH in many cases.

You can configure things: see the readme: pass a urlTransform option!

@wooorm Maybe it's worth to mention that we follow GitHub's behavior as default at https://github.com/remarkjs/react-markdown#security

[wooorm]

Thanks for the suggestion. I added a paragraph on the internal workings of defaultUrlTransform. I think it fits better there!