Merge "SECURITY: XSS in unclosed internal links"