#8 Security: [img] tags emit raw text for invalid URLs

[phantom-inker]

[img] tags, when they find a URL that's not valid, are supposed to emit a plaintext version of the original contents. They do this, but they fail to encode the HTML, so that it's possible to inject raw HTML into the output via [img] tags. This allows XSS, redirection, and other cookie-stealing attacks against end-users.

[phantom-inker]

This has been fixed in release v1.4.2.