waylan/Python-Markdown — pull request #185 by phihag (2013-02-05 17:57:47+00:00)
Title: Prevent javascript:// URLs

This pull request prevents JavaScript URLs and fixes an [XSS attack](http://en.wikipedia.org/wiki/Cross-site_scripting) that worked even when safe_mode was set.

In the long term, I think it would be certainly a great idea to allow users to lock down the allowed schemes, and default to something sensible, like `http`, `https`, `mailto`, `news` and maybe `tel`.