renderer link not escaped

[zTrix]

>>> markdown('**blah** [asdfasdf](blasdfh">)')
'<p><strong>blah</strong> <a href="blasdfh">">asdfasdf</a></p>\n'

github rendered:

blah asdfasdf afd

[qll]

Just for the sake of completeness, here is an actual XSS vector using JavaScript (avoiding the parantheses by using templates)

>>> mistune.markdown('[text]("><script>alert`1`</script>)')
'<p><a href=""><script>alert`1`</script>">text</a></p>\n'

[qll]

@nitely found out that the same problem appears in images, too. This could be moved to an own issue or be collected in here, but that's your call.

>>> mistune.markdown('![text]("><script>alert`1`</script>)')
'<p><img src=""><script>alert`1`</script>" alt="text"></p>\n'

[Kingwl]

it's very helpful to me!