liip/LiipUrlAutoConverterBundle — pull request #12 by tirithen (2013-11-26 10:57:12+00:00)
Title: Add secureconverturls filter to prevent JavaScript and HTML tag injections

Since this would change the behaviour of the converturls filter (like make it impossible to in a secure way let a tags be passed through as they could contain JavaScript), I added a new filter called secureconverturls instead. Feel free to change code in any way needed as long as pre_escape is used I think the HTML output should be safe. The only thing I'm sure of is if there are any variations of strings that could be converted to something like alert, I tested a few like domain.com/news;javascript:alert('hello'); and it seems okay...