marked/test/new/mangle_xss.html

<p><a href="mailto:&lt;svg/onload=&quot;alert(1)&quot;//@x">&lt;svg/onload=&quot;alert(1)&quot;//@x</a></p>

<p><a href="mailto:bar&quot;onclick=&quot;alert(&#39;XSS&#39;)&quot;@foo">bar&quot;onclick=&quot;alert(&#39;XSS&#39;)&quot;@foo</a></p>