* Don't give attackers an opening by echoing back known bad parameter inputs.

* Don't give attackers an opening by echoing back known bad parameter inputs.
* Create magic links only using a whitelist of protocols.

Have no proof of vuln, but allowing the user to make JavaScript links and have a lot of control over what goes into them probably isn't desirable.
Example attack input:
  http://en.wikipedia.org/w/api.php?action=query&meta=javascript://**/alert(1);

Example pre-patch HTML output contains this string:
  <a href="javascript://**/alert">javascript://**/alert</a>(1);
Which doesn't work, due to:
 1) the double slash - one slash someone can work around by faking a C-style comment (by appending "**/" as shown above), but two is a problem
 2) the parentheses being excluded, so we can't pass parameters
... but best to put a stop to it anyway.