Links in href/src needs a protocol, but not in url(), why ?

[sky0matic]

Hi there,

We notice that this library was removing links in href/src where there was no protocol.
However, the same doesn't apply to links in url() in style attributes on a background-image for example.

Why is that ?

Is there a security risk involving the need for a protocol ? If so, why does it not apply to url() too ?
If not, why is the protocol required in one place but not the other ?

Thanks