JS Injection Fix PR

Fixes a bug that would allow for javascript injection into the editor. Improves on a previous solution.

/cc @koke , @SergioEstevao 
This regex wouldn't match something like this:

```html
<img src="foo>" onerror="alert('test')">
```