blacklist vbscript: fixes #492

[evilpacket]

No description provided.

[alduethadyn]

Will this fix be merged?

[yoshuawuyts]

Do note that this warrants a new (patch) release, just merging it in won't be sufficient.

[alduethadyn]

true enough - should have been more clear

[okuryu]

@chjj Could you publish to npm?

[chjj]

Done.

[chjj]

I also want to say to everyone, and @naholyr: PRs for the sanitizer are welcome. The sanitizer is something I added on a whim just because I could. I try to make it as secure as possible, but I would never make a guarantee that it is absolutely secure. If you care about security, you should use a more heavy duty html sanitizer. Hopefully one day we can get to that point though.

[naholyr]

I'm pretty clear with that, to be fully honest the aim of my comment was more like well, I'm not sur it worth the effort knowing there will always be an unplanned edge case ;)

I'd go for a warning in the README (+ link to http://htmlpurifier.org/ for example?).