XSS src needs to be checked if its an URL, like /^(?:https?:)\/\/