It excludes all html tags and attributes except for those that are
whitelisted using the same lists as used by Mark Pilgrim's Universal Feed
Parser, documented at <http://feedparser.org/docs/html-sanitization.html>.
-Notably it strips `style`, `link`, and the `style` attribute.
+Notably it strips `style` and `link` tags, and the `style` attribute.
It uses the [[cpan HTML::Scrubber]] perl module to perform its html
sanitisation, and this perl module also deals with various entity encoding
* <span style="background: url(javascript:window.location='http://example.org/')">CSS script test</span>
* <span style="any: expression(window.location='http://example.org/')">entity-encoded CSS script test</span>
* <span style="any: expression(window.location='http://example.org/')">entity-encoded CSS script test</span>
+* <a href="javascript:alert('foo')">click me</a>