code: public HtmlPolicyBuilder allowUrlProtocols(String... protocols) {
      invalidateCompiledState();
      // If there is at least one allowed protocol, then allow URLs and
      // add a filter that checks href and src values.
  
      // Do not allow href and srcs through otherwise, and only allow on images
      // and links.
      for (String protocol : protocols) {
        protocol = Strings.toLowerCase(protocol);
        allowedProtocols.add(protocol);
      }
      return this;
    }
docs: Adds to the set of protocols that are allowed in URL attributes.
  For each URL attribute that is allowed, we further constrain it by
  only allowing the value through if it specifies no protocol, or if it
  specifies one in the allowedProtocols white-list.
  This is done regardless of whether any protocols have been allowed, so
  allowing the attribute "href" globally with the identity policy but
  not white-listing any protocols, effectively disallows the "href"
  attribute globally.
  <p>
  Do not allow any <code>*script</code> such as <code>javascript</code>
  protocols if you might use this policy with untrusted code.