XSS through author's url in comments

[xknown]

Due to bad validation of author's url value in comments, someone can easily inject javascript code in the href attribute:

You can try with this value in the author's url field:

javascript:alert(document.cookie);v//://

To "exploit" this bug, as you can see, it needs user (logged) interaction

PS. Sorry for my bad English

[andy]

Attached proto.diff which forces clean_url through wp_kses_bad_protocol with the default protocol list. E.g. if "javascript:" is the protocol it will return an empty string rather than a "sanitized" URL.

This can be applied to 2.0 and trunk.

[ryan]

(In [4672]) Add kses protocol checking to clean_url. Props Andy. fixes #3515