Vulnerability in removeScripts plugin

[caghand]

The removeScripts plugin is doing a pretty good job, but it has these three blind spots:

1. <set> element that matches all of the following:
   1. refers to an <a> element.
   2. has an attributeName attribute that equals href or xlink:href.
   3. has a to attribute that starts with javascript:.
2. <animate> element that matches all of the following:
   1. refers to an <a> element.
   2. has an attributeName attribute that equals href or xlink:href.
   3. matches one of the following:
      1. has a from attribute that starts with javascript:.
      2. has a to attribute that starts with javascript:.
      3. has a values attribute that contains javascript:.
3. Different capitalizations of javascript:, like JAVASCRIPT: or JaVaScRiPt:, in the href or xlink:href attribute of an <a> element, and in the cases mentioned above.

It would be great to cover these gaps, so that the plugin does not lead people to a false sense of security. :)

Thanks!