A blacklist of URI schemes is not reliable.
There is no common list of bad URI schemes because it's just not possible to build a complete one. There are lots of non-standard schemes for different browsers and more could be added in the future. (One example of a dangerous non-standard scheme would be
livescript: for old Netscape versions.)
This is another good point:
I do not allow bitcoin: on my servers, nor anything except for http,
https, or ftp.
The reason is because I have no way of knowing what third party
applications might have vulnerabilities (including social engineering)
that could be exploited by a specially crafted URI string being fed to them.
Similarly, there is no blacklist of dangerous HTML tags because - although standardized - browsers still go their own ways with custom tags. Building a comprehensive list would be hopeless.
Another problem is that you could run into problems with nested schemes. What about
So it's safer to agree on a whitelist of acceptable schemes and add more on demand. E.g., this is the default on Wordpress:
(array) (optional) An array of acceptable protocols. Defaults to '
xmpp' if not set.