RedCloth Cross Site Scripting

`I disclosed the following advisory about a XSS vulnerability of  
RedCloth (Textile library for Ruby).  
http://co3k.org/blog/redcloth-unfixed-xss-en  
  
You shouldn't use RedCloth to parse user inputted contents and output  
the parsed string (except that you allow your  
user to write arbitrary JavaScript code on your site) because it  
contains unfixed XSS vulnerability for 9 years,  
and it be also disclosed for 2 years.  
  
Unfortunately, we may not expect fix the vulnerability by the current  
developer because he announced that "unable to  
keep fixing bugs or work on the next major release".  
  
If you want to continue to use RedCloth for such contents, you should  
patch for the problem yourself, consider  
contributing to RedCloth, or otherwise.  
  
PoC  
===  
  
```  
require 'redcloth'  
  
print RedCloth.new('["clickme":javascript:alert(%27XSS%27)]',  
[:filter_html, :filter_styles, :filter_classes, :filter_ids]).to_html  
  
# Result:  
# <p><a href="javascript:alert(%27XSS%27)">clickme</a></p>  
```  
  
Timeline  
========  
  
* Feb. 24, 2012 : I reported the problem to a developer (by sending e-mail)  
* Feb. 29, 2012 : A developer discloses the issue in this ticket:  
http://jgarber.lighthouseapp.com/projects/13054-redcloth/tickets/243-xss  
* ...  
* Sep. 24, 2014 : Announced "RedCloth needs new maintainers" to take  
over RedCloth by a developer:  
https://github.com/jgarber/redcloth/commit/b24f03db023d1653d60dd33b28e09317cd77c6a0  
  
  
`