Trello now sanitizing URLs / disallowing custom url protocols?

Question

Up until about yesterday, I was able to add markdown links to a local application within the description area of my Trello Cards.

The application uses a custom url protocol to produce a url like the following:

ttstudio://server:99//Product/dfct?recordID=3836

I've been adding these references to my trello cards in the markdown format:

[3836](ttstudio://server:99//Product/dfct?recordID=3836)

where they'd render as

<a href="ttstudio://server:99//Product/dfct?recordID=3836">3836</a>

I just went back to one of these cards and noticed that the href now renders as

<a href="#">3836</a>

Which completely disables the link.

Changing to a standard protocol (http, https, ftp) renders the href correctly, which makes me think they've recently disabled custom/non-standard url protocols.

Anyone else experiencing this? Anyone know if this was changed on purpose and why? Is this documented anywhere that I can reference?

Their development board doesn't seem to indicate any changes were made, but I'm sure they don't post every change they make.

Answer 1

Non-standard protocols were disabled as a security precaution, to prevent the use of dangerous URIs (e.g. javascript:) from being rendered.

See https://github.com/evilstreak/markdown-js/pull/52 for a pull request with more details.