[SECURITY] Link fields accept Javascript code when using URI Data Scheme