Patching XSS vulnerability

The following message produces a clickable link that triggers JavaScript when clicked (pre-patch):
`javascript://www.google.com/?%0Aalert(0);`

Patch was designed to prevent this while maintaining support for arbitrary link protocols.