kalenjordan/magehero — pull request #21 by kojiromike (2014-10-29 02:38:11+00:00)
Title: Simple Validation to Prevent XSS

In its current form you can inject `javascript:` and presumably `data:` urls in most of the JSON url fields. The below validation proposal, while simple, should prevent at least vectors involving invalid urls in the StackOverflow or Magento Certification fields.