Bug fixed ZK-1943: XSS Vulnerability: It's possible to pass JavaScript over URL http://tracker.zkoss.org/browse/ZK-1943