encodeURI the href to prevent XSS attacks via ending the quote and adding arbitrary scripts in onmouseover/onclick

[mrooney]

Without this fix, a link such as:

http://xss.com/"onmouseover=alert('XSS');//

is a vulnerability.

I don't know how to minify the code so it would need a regen of the minified code, but this addresses the issue AFAIK.

[jbaudanza]

The problem with this is that non-malicious links will already be properly URI encoded. Calling encodeURI will double encode them. Perhaps something like this would be more appropriate:

if (href) {
  href = href.replace('"', '%22');
}