Bug 31165 added scrubbing to course reserves public note Many libraries use the public note to link to courses on their website, other resources, etc. Additionally bug 33337 talks about scrubbing patron public notes, but those are also used sometimes for links, such as other patrons that can check out their items but not guarantaurs. I recommend changing it to something like what Lucas did on Bug 38960 https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=183774&action=diff which allows for some links but is not all links: a => { href => qr{^(?:https?://|/cgi-bin/|mailto:|#)}i, class => qr/^[\w\s\-_]+$/, title => 1, target => qr/^_(?:blank|self|parent|top)$/, rel => qr/^(?:nofollow|noopener|noreferrer|noindex|bookmark|tag|prev|next|up|alternate|author|help|license|search)$/, property => qr/^[\w\s]+$/, typeof => qr/^[\w\s]+$/, resource => qr/^[#\w\-_]+$/, },
*** Bug 38498 has been marked as a duplicate of this bug. ***
I opened bug 38498 a while ago to add "id" and "class", but this makes a lot of sense too in terms of attributes. As for the "a" element... I think we'll want to be careful. I created the "note" profile to be re-usable for other types of notes. If it's staff-created notes, it's probably fine. If it's user-created notes, then there's some danger.
Btw in this case, I don't think we'd need the "property", "typeof", or "resource" attributes, since those are specific to Schema.org for the record display.