Fix url links

packages/rocketchat-markdown/markdown.coffee

@@ -18,17 +18,17 @@ class Markdown
 		# Support ![alt text](http://image url)
 		msg = msg.replace new RegExp("!\\[([^\\]]+)\\]\\(((?:#{schemes}):\\/\\/[^\\)]+)\\)", 'gm'), (match, title, url) ->
 			target = if url.indexOf(Meteor.absoluteUrl()) is 0 then '' else '_blank'
-			return '<a href="' + url + '" title="' + title + '" target="' + target + '"><div class="inline-image" style="background-image: url(' + url + ');"></div></a>'
+			return '<a href="' + _.escapeHTML(url) + '" title="' + _.escapeHTML(title) + '" target="' + _.escapeHTML(target) + '"><div class="inline-image" style="background-image: url(' + _.escapeHTML(url) + ');"></div></a>'
 
 		# Support [Text](http://link)
 		msg = msg.replace new RegExp("\\[([^\\]]+)\\]\\(((?:#{schemes}):\\/\\/[^\\)]+)\\)", 'gm'), (match, title, url) ->
 			target = if url.indexOf(Meteor.absoluteUrl()) is 0 then '' else '_blank'
-			return '<a href="' + url + '" target="' + target + '">' + title + '</a>'
+			return '<a href="' + _.escapeHTML(url) + '" target="' + _.escapeHTML(target) + '">' + _.escapeHTML(title) + '</a>'
 
 		# Support <http://link|Text>
 		msg = msg.replace new RegExp("(?:<|&lt;)((?:#{schemes}):\\/\\/[^\\|]+)\\|(.+?)(?=>|&gt;)(?:>|&gt;)", 'gm'), (match, url, title) ->
 			target = if url.indexOf(Meteor.absoluteUrl()) is 0 then '' else '_blank'
-			return '<a href="' + url + '" target="' + target + '">' + title + '</a>'
+			return '<a href="' + _.escapeHTML(url) + '" target="' + _.escapeHTML(target) + '">' + _.escapeHTML(title) + '</a>'
 
 		if RocketChat.settings.get('Markdown_Headers')
 			# Support # Text for h1