[SECURITY] Disallow javascript & data scheme in URL link handler