Why does the Rails sanitizer remove hrefs that contain capitalized URLs?

An example:

[Dev]>   ActionController::Base.helpers.sanitize('<a 开发者_如何学Chref="http://google.com">test</a>')
=> '<a href="http://google.com">test</a>'
[Dev]>   ActionController::Base.helpers.sanitize('<a href="Http://google.com">test</a>')
=> '<a>test</a>'

Extremely frustrating!

This seems to be a bug in the method contains_bad_protocols? in action_controller/vendor/html-scanner/html/sanitizer.rb. This method is defined as:

def contains_bad_protocols?(attr_name, value)
    uri_attributes.include?(attr_name) && 
    (value =~ /(^[^\/:]*):|(&#0*58)|(&#x70)|(%|%)3A/ 
        && !allowed_protocols.include?(value.split(protocol_separator).first))
end

And allowed_protocols as:

self.allowed_protocols = Set.new(%w(ed2k ftp http https irc mailto news gopher nntp 
    telnet webcal xmpp callto feed svn urn aim rsync tag ssh sftp rtsp afs))

Thus:

allowed_protocols.include? 'http' => true
allowed_protocols.include? 'Http' => false