Is this `img` creator decently secure from XSS?
The part of your code shown here does not look like it's vulnerable to XSS, but it could be cleaner. You seem to be doing 3 separate things:


Ensuring that a URI looks like a path to an image.
Ensuring that a URI doesn't contain certain characters like quotes and angle brackets.
Trimming whitespace from the ends of a URI.


Doing those things in discreet steps would be cleaner. If you trim the string first, you won't need to look at the match results, only check whether there was a match. That means you can avoid the poor style used in the construct if (m=foo) without having to rewrite that part, and you can eliminate redundancy.

You could use encodeURI instead of throwing out URIs with certain characters; this way the user doesn't have to encode those characters before passing you the string.

s = s.trim();
if (s.match(/^https?:\/\/.*?\.(bmp|png|webp|gif|jpg|jpeg|svg)(\?.*)?$/)) {
    // looks like a path to an image
    return '&lt;img src="' + encodeURI(s) + '"&gt;';
}


If you are doing this on the client, consider creating an image element and returning that instead of returning a string.

s = s.trim();
if (s.match(/^https?:\/\/.*?\.(bmp|png|webp|gif|jpg|jpeg|svg)(\?.*)?$/)) {
    var img = new Image();
    img.src = encodeURI(s);
    return img;
}


Also, the regular expressions you are using and the one in this example will match things like http://lol.jpg; you may want to consider making it more strict.