XSS in IE

[albertshaw]

Though set sanitize option to true could filter some xss code, but it still miss a link case in IE.

use:

[xss link](vbscript:alert(1))

will get a link

<a href="vbscript:alert(1)">xss link</a>

this script does not work in IE 11 edge mode, but works in IE 10 compatibility view.