punkave/sanitize-html — pull request #15 by jimmed (2014-07-17 11:41:50+00:00)
Title: Protect against comments in URI schemes (i.e. java<!-- -->script)

It is possible to inject the following:

which (assuming 'i', 'b', 'img' and 'src' are permitted), will yield:

While I'm not sure that this is ever interpreted by browsers without an [XML data island](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#XML_data_island_with_CDATA_obfuscation) (which is stripped by your default tag whitelist), it is still worrying to see the attack payload appear in output, so here's a fix.