Our XSS library doesn't provide a way to sanitize full URLs, so I'm not sure if there's anything we should do. I'm guessing that it would be possible to put a `"` in the URL and cause it to close the href attribute. I'll try to provide a fix.