+ * This hardcodes a small set of protocols only, because we want to
+ * deterministically reject protocols not supported by all HTTP-transport
+ * methods.
+ *
+ * "file://" specifically must not be allowed, for security purpose
+ * (see <https://www.mediawiki.org/wiki/Special:Code/MediaWiki/r67684>).