SECURITY: Stripping links could unescape html fragments