src/vs/base/browser/dom.ts/hookDomPurifyHrefAndSrcSanitizer
export function hookDomPurifyHrefAndSrcSanitizer(allowedProtocols: readonly string[], allowDataImages = false): IDisposable {
	// https://github.com/cure53/DOMPurify/blob/main/demos/hooks-scheme-allowlist.html

	// build an anchor to map URLs to
	const anchor = document.createElement('a');

	dompurify.addHook('afterSanitizeAttributes', (node) => {
		// check all href/src attributes for validity
		for (const attr of ['href', 'src']) {
			if (node.hasAttribute(attr)) {
				const attrValue = node.getAttribute(attr) as string;
				if (attr === 'href' && attrValue.startsWith('#')) {
					// Allow fragment links
					continue;
				}

				anchor.href = attrValue;
				if (!allowedProtocols.includes(anchor.protocol.replace(/:$/, ''))) {
					if (allowDataImages && attr === 'src' && anchor.href.startsWith('data:')) {
						continue;
					}

					node.removeAttribute(attr);
				}
			}
		}
	});

	return toDisposable(() => {
		dompurify.removeHook('afterSanitizeAttributes');
	});
}