asceth/bbcoder — pull request #13 by iGEL (2012-05-13 18:44:35+00:00)
Title: XSS fixed in default tags and docs

The tags `[url]` and `[img]` don't restrict the given URL, so one could inject `[url=javascript:alert('You got hacked!')]`. I took the white listing approach, disallowing everything but http:// and https://