wire not filtering input properly

[DJPaul]

It's possible to get Javascript into the following on any of the Wire elements:

<a href="javascript:window.location.href='www.google.com'">Tsst</a>

[Jason_JM]

You may be able to use the filter 'bp_get_wire_post_content':

pseudo
if (!'javascript:' present in the href via regex) {

replace href = "javascript:window.location.href='<old href>'"

Sound good?

Enhancement,minor, 1.2?

[djpaul]

This is an important issue because I could craft a link to potentially execute a harmful JavaScript action (if an admin clicks on it).

[apeatling]

kses should be filtering this, I will investigate.

[apeatling]

This is fixed in trunk, please reopen if you find it is not for you after updating.