Patching XSS vulnerability

The following message produces a clickable link that triggers JavaScript when clicked (pre-patch):
javascript://www.google.com/?%0Aalert(0);

Patch was designed to prevent this while maintaining support for arbitrary link protocols.
Merge pull request #555 from Pseudochu/development

Patching XSS vulnerability