Cross Site Scripting In Profile Statement

The researcher @muhaddimu found that during the conversion of `` to HTML by [misaka](http://misaka.61924.nl/), the `src` field of the generated `img` tag is not sanitized. It allows the usage of sources like `data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K`. While we were not able to find any browser interpreting this attribute while rendering the page (no alert windows is shown), it can be only triggered by doing a right click on the element and then choosing "Open in a new tab". By doing so, the browser interprets the javascript code in another context than gratipay.com—it's impossible to get user's cookies (in addition of the `HttpOnly` flag) or to make any XHR request to gratipay.com. Since we can't find any direct security implication of this behaviour, this issue was not considered to be a security risk.