A blacklist of URI schemes is not reliable.
There is no common list of bad URI schemes because it's just not possible to build a complete one. There are lots of non-standard schemes for different browsers and more could be added in the future. (One example of a dangerous non-standard scheme would be livescript:
for old Netscape versions.)
This is another good point:
I do not allow bitcoin: on my servers, nor anything except for http,
https, or ftp.
The reason is because I have no way of knowing what third party
applications might have vulnerabilities (including social engineering)
that could be exploited by a specially crafted URI string being fed to them.
(Source)
Similarly, there is no blacklist of dangerous HTML tags because - although standardized - browsers still go their own ways with custom tags. Building a comprehensive list would be hopeless.
Another problem is that you could run into problems with nested schemes. What about view-source:data:...
, rss:jar:...
, etc.?
So it's safer to agree on a whitelist of acceptable schemes and add more on demand. E.g., this is the default on Wordpress:
$protocols
(array) (optional) An array of acceptable protocols. Defaults to 'http
', 'https
', 'ftp
', 'ftps
', 'mailto
', 'news
', 'irc
', 'gopher
', 'nntp
', 'feed
', 'telnet
', 'mms
', 'rtsp
', 'svn
', 'tel
', 'fax
', 'xmpp
' if not set.
(Source)