fix: block javascript docset links

lib/docset_renderer.php

@@ -93,7 +93,12 @@ class DocsetRenderer
 		if($value === '' || str_starts_with($value, '#'))
 			return $value;
 		$lower = strtolower($value);
-		foreach(array('http://', 'https://', 'mailto:', 'data:', 'javascript:', 'about:') as $prefix)
+		foreach(array('javascript:', 'vbscript:') as $prefix)
+		{
+			if(str_starts_with($lower, $prefix))
+				return '#blocked-unsafe-url';
+		}
+		foreach(array('http://', 'https://', 'mailto:', 'data:', 'about:') as $prefix)
 		{
 			if(str_starts_with($lower, $prefix))
 				return $value;