Shortcode return vs echo. Return messes with data URLs, echo does not

Question

I am trying to create add-to-calendar links using shortcode. However when using return following shortcode function outputs a broken link. (echo does not!). Wordpress documentation recommends using return and I am worried if echo, even when it works, is the safe way of doing this.

<?php
add_shortcode('calendar-links', 'shortcode_function');

shortcode_function (){
  $link = '<a href="data:text/calendar;charset=utf8;base64,QkVHSU46VkNBTEVOREFSDQpWRVJTSU...">Download</a>';
  return $link;
}

The output of return is as below:

<a href="https://localhost/text/calendar;charset=utf8;base64,QkVHSU46VkNBTEVOREFSDQpWRVJTSU...">Download</a>

I am assuming the shortcode output is going through some kind of sanitisation, but unable to find a fix for it. Also, if it helps, the shortcode is being outputted using an Elementor shortcode widget.

Answer 1

Thanks to @fuxia, adding data to allowed protocols fixes the problem and I can happily use return.

add_filter( 'kses_allowed_protocols', function ( $protocols ) {
    $protocols[] = 'data';
    return $protocols;
} );