Repository: mozilla/bleach

Issue:
bug: Relative url is removed when the allowed protocol is https
**Describe the bug**

bleach.clean does not keep the relative url when the allowed protocol is https

** python and bleach versions (please complete the following information):**

 - Python Version: 2.7.18
 - Bleach Version: 3.3.1

**To Reproduce**

Steps to reproduce the behavior:
```
from bleach.sanitizer import Cleaner
BleachCleaner = Cleaner(
    tags=['a', 'br'],
    attributes={'a': 'href'},
    styles=[],
    protocols=['https'],
    strip=True,
    strip_comments=True
)

description = 'create new study <a href="/path/to/study">Mental study</a>'
BleachCleaner.clean(description)
```

**Expected behavior**
In bleach version 2.0.0, the relative url is not removed from the result: 
**'create new study <a href="/path/to/study">Mental study</a>'**

**Actual behavior**
In bleach version 3.3.1, the relative url is removed from the result:
**'create new study <a>Mental study</a>'**

**Additional context**
<img width="721" alt="Screen Shot 2022-05-09 at 11 14 27" src="https://user-images.githubusercontent.com/98076735/167339622-a242d63d-934d-4c67-a2a1-582a6e62a280.png">
<img width="721" alt="Screen Shot 2022-05-09 at 11 14 50" src="https://user-images.githubusercontent.com/98076735/167339629-1aa1e03c-86a7-4049-898d-f4a67ad965d7.png">




Discussion:

Patch:
diff --git a/bleach/sanitizer.py b/bleach/sanitizer.py
index 51ec562..3a222a1 100644
--- a/bleach/sanitizer.py
+++ b/bleach/sanitizer.py
@@ -488,9 +488,9 @@ class BleachSanitizerFilter(html5lib_shim.SanitizerFilter):
             if ":" in new_value and new_value.split(":")[0] in allowed_protocols:
                 return value
 
-            # If there's no protocol/scheme specified, then assume it's "http"
-            # and see if that's allowed
-            if "http" in allowed_protocols:
+            # If there's no protocol/scheme specified, then assume it's "http" or
+            # "https" and see if that's allowed
+            if "http" in allowed_protocols or "https" in allowed_protocols:
                 return value
 
         return None


Test patch:
diff --git a/tests/test_clean.py b/tests/test_clean.py
index ab11253..b8e9cf1 100644
--- a/tests/test_clean.py
+++ b/tests/test_clean.py
@@ -542,12 +542,17 @@ def test_attributes_list():
             {"protocols": []},
             '<a href="#example.com">foo</a>',
         ),
-        # Allow implicit http if allowed
+        # Allow implicit http/https if allowed
         (
             '<a href="/path">valid</a>',
             {"protocols": ["http"]},
             '<a href="/path">valid</a>',
         ),
+        (
+            '<a href="/path">valid</a>',
+            {"protocols": ["https"]},
+            '<a href="/path">valid</a>',
+        ),
         (
             '<a href="example.com">valid</a>',
             {"protocols": ["http"]},
@@ -586,7 +591,7 @@ def test_attributes_list():
             ),
             marks=pytest.mark.xfail,
         ),
-        # Disallow implicit http if disallowed
+        # Disallow implicit http/https if disallowed
         ('<a href="example.com">foo</a>', {"protocols": []}, "<a>foo</a>"),
         ('<a href="example.com:8000">foo</a>', {"protocols": []}, "<a>foo</a>"),
         ('<a href="localhost">foo</a>', {"protocols": []}, "<a>foo</a>"),