Raised in https://github.com/spring-projects/spring-boot/issues/25384, I think it makes sense to sanitize the values of url
and urls
fields in the same way as we sanitize the values of uri
and uris
fields.
Flagging for team attention in case I've overlooked a reason for URLs to be handled differently to URIs.