Symfony version(s) affected

6.1

Description

Originally reported by @Stoakes in symfony/symfony-docs#17446

@tgalopin suggested that this might be a bug in code instead of a doc issue.

How to reproduce

The following config:

html_sanitizer:
    sanitizers:
        app.sanitizer:
            allow_safe_elements: true
            allow_elements:
                list: '*'
                table: 'class'
                code: '*'
                a: ['href']
            allowed_media_schemes: ['http', 'https', 'mailto']
            allow_relative_medias: false

Results in the removal of all href attributes from all <a> elements. To fix this issue, you must also add the following to the previous config: allowed_link_schemes: ['http', 'https', 'mailto']

The original config should work without having to add the allowed_link_schemes config.

Possible Solution

No response

Additional Context

No response