GeezerVison

Since the percent-decoded check for denied characters was added to UrlSanitizer::parse(), a mailto: URL with a multi-line body was rejected and the link lost its href silently. RFC 6068 requires line breaks in the body to be encoded as %0D%0A, so a URL that follows the scheme's own specification was dropped.

The check now ignores percent-encoded CR, LF and TAB in the query and fragment of hostless schemes (mailto, sms, tel, ...). Everything else is unchanged: those characters stay rejected in every other component, for every scheme with an authority (https://example.org/a?x=1%0A2 is still rejected), and the BiDi marks and Unicode whitespace stay rejected everywhere, encoded or not. The output keeps the percent-encoded form.

Before: <a href="mailto:[email protected]?body=send%20current-issue%0D%0Asend%20index">contact</a> became <a>contact</a>.
After: <a href="mailto:infobot&#64;example.com?body&#61;send%20current-issue%0D%0Asend%20index">contact</a>.

The \v escape in the denied-characters pattern is PCRE's vertical whitespace class, not the vertical tab; it is replaced by \x0B. This changes nothing, since every character \v matches is listed explicitly in the pattern.