diff --git a/src/HtmlUtils.js b/src/HtmlUtils.js index 87e714083b..f1ce6a6a12 100644 --- a/src/HtmlUtils.js +++ b/src/HtmlUtils.js @@ -152,7 +152,7 @@ const sanitizeHtmlParams = { // Lots of these won't come up by default because we don't allow them selfClosing: ['img', 'br', 'hr', 'area', 'base', 'basefont', 'input', 'link', 'meta'], // URL schemes we permit - allowedSchemes: ['http', 'https', 'ftp', 'mailto'], + allowedSchemes: ['http', 'https', 'ftp', 'mailto', 'magnet'], allowProtocolRelative: false,