Anchor all reUnsafeProtocol alternatives to the start of the URL

Author: GrahamCampbell

lib/render/html.js

@@ -3,7 +3,7 @@
 import { escapeXml } from "../common.js";
 import Renderer from "./renderer.js";
 
-var reUnsafeProtocol = /^javascript:|vbscript:|file:|data:/i;
+var reUnsafeProtocol = /^(?:javascript|vbscript|file|data):/i;
 var reSafeDataProtocol = /^data:image\/(?:png|gif|jpeg|webp)/i;
 
 var potentiallyUnsafe = function(url) {