javascript: URLs not filtered out properly

[ryan-copperleaf]

Posting it here because it’s not really a risk. One bypass:

[foo][1]

  [1]: javascript:alert(1)

The important thing is the uppercase X. Working:

[gka]

from what I see this is still an open issue in marked, but it seems the folks over there are finally on track to fix it. will give this a few more days, if nothing happens here we'll switch to a different markdown renderer.

[styfle]

See markedjs/marked#587 (comment)

[Feder1co5oave]

This was fixed in markedjs/marked#976

[g-div]

Fixed, thanks!