consider whitelist for safe protocols

[stefanpenner]

htmlbars/packages/morph-attr/lib/sanitize-attribute-value.js

Line 5 in 3035edf

'vbscript:': true

[neraliu]

@stefanpenner, I have a more comprehensive list of tags and attributes those are regarded as unsafe for URI context, i can help out for creating a PR for this feature.
https://github.com/yahoo/xss-filters/blob/master/src/xss-filters.js#L58 (tag names)
https://github.com/yahoo/secure-handlebars/blob/master/src/parser-utils.js#L31 (attributes name)

[stefanpenner]

@neraliu i wonder if we should make the blacklist/whitelist a common node_module, that way test/auditing/sharing is more centralized. Does this seem possible?

[neraliu]

@stefanpenner yes we can make it as a standalone npm module for testing/auditing/sharing. and I am wondering what is the default behavior of the htmlbars when it encounters URI context, blacklist or whitelist? what general developers are expecting?