Fixed vulenarability in default config of html cleaner
javascript: and data: could've been passed without filtering in href attribute of <a> tag (http://habrahabr.ru/post/164539/)