fix: link checking missing scheme

[hamza221]

No description provided.

[ChristophWurst]

This smells like a case that can be unit-tested 😈

[SebastianKrupinski]

Does the code check for dangerous URL schemes like "file://" or "ftp://"?

[hamza221]

Does the code check for dangerous URL schemes like "file://" or "ftp://"?

How are these schemes dangerous for phishing? sorry my knowledge is limited about the cases.
Let's discuss either in a private message and I'll open an issue for it, or you can also open one and assign me.

[kesselb]

This pull request is about fixing a problem we discussed in the public chat.
As shown below the warning is triggered even if the urls are using the same host.

The reason is that parse_url does not work if the given string does not contain something that looks like a protocol:
https://3v4l.org/cap3C (it would also work to use "dummy://" instead of "http://").

An additional check, does the mail contain links with unusual protocols, sounds like a good enhancement to me.
I'd say that should go into a new issue.

[SebastianKrupinski]

Does the code check for dangerous URL schemes like "file://" or "ftp://"?

How are these schemes dangerous for phishing? sorry my knowledge is limited about the cases. Let's discuss either in a private message and I'll open an issue for it, or you can also open one and assign me.

I don't know if they are dangerous for phishing specifically but they are dangerous in general. For instance "ftp://domain/folder/file.doc" will trigger the download and opening of a external file. "file://folder/file.exe" will trigger the opening of a local executable. This in not a blocker for me, just thought the warning could be included also.