\n Here's a link to my notion:\n notion://notion.so/user/123\n
\n```\n\nMake sure you understand the security implications before using this plugin: [Security](#security)\n\nHeavily inspired by [remark-linkify-regex](https://gitlab.com/staltz/remark-linkify-regex) but different enough to justify a separate plugin.\n\nBootstrapped and built with [tsdx](https://github.com/formium/tsdx).\n\n## Installation\n\nUse [npm](https://www.npmjs.com/get-npm) or [yarn](https://yarnpkg.com/lang/en/docs/install/) to install:\n\n```sh\nnpm install @doist/remark-application-links\n# or\nyarn add @doist/remark-application-links\n```\n\n## Usage\n\nThis plugin exposes a function which you need to call with the blocked URL schemes (or with nothing to accept the default ones).\n\n```js\nremark().use(remarkApplicationLinksPlugin())\n// or with custom schemes\nremark().use(remarkApplicationLinksPlugin(['javascript', 'notion']))\n```\n\n## Security\n\nSince this plugin is using a block list of URL schemes instead of explictly allowing explicit ones it potentially opens up your application for attackers. The general stance in the security community is that a complete block list is hard (read: impossible) to achieve. If you want to be on the safe side it's better to rely on an explicit allow list of supported URL schemes.\n\nPer default we're blocking these url schemes:\n\n```js\nconst blockedUrlSchemes = ['data', 'jar', 'java', 'javascript', 'vbscript', 'view-source']\n```\n\nIn general it's recommended to not only rely on your parser to prevent inline script executions but apply a Content-Security Policy (CSP) on your page as reliable catch-all.\n\nYou're advised to thoroughly test your use cases to not open your users up to [cross-site scripting (XSS)](https://en.wikipedia.org/wiki/Cross-site_scripting) attacks. You might find additional tools like [rehype-sanitize](https://github.com/rehypejs/rehype-sanitize) helpful.\n\n### Markdown links and react-markdown\n\nThis plugin will transform this text:\n\n```md\n[link](