Is this `img` creator decently secure from XSS? This is being used now, seems decent to me but I'm curious. 

    if (m=s.match(/^\s*(https?:\/\/[^\s&lt;&gt;"]+)\.(bmp|png|webp|gif|jpg|jpeg|svg)\s*$/)) { 
         // example s: http://mustachify.me/?src=http://www.someImage.jpg
        return '&lt;img src="'+m[1]+'.'+m[2]+'"&gt;';
    }
    if (m=s.match(/^\s*(https?:\/\/[^\s&lt;&gt;?"]+)\.(bmp|png|webp|gif|jpg|jpeg|svg)(\?[^\s&lt;&gt;?"]*)?\s*$/)) {
        // example s: http://place.com/photo/something.jpg?height=600&amp;modified_at=1384796271&amp;ratio_x=03&amp;ratio_y=02&amp;width=900
        return '&lt;img src="'+m[1]+'.'+m[2]+(m[3]||'')+'"&gt;';
    }


I've been trying to get around it but haven't yet managed it. So I'm thinking of just using this.
The part of your code shown here does not look like it's vulnerable to XSS, but it could be cleaner. You seem to be doing 3 separate things:


Ensuring that a URI looks like a path to an image.
Ensuring that a URI doesn't contain certain characters like quotes and angle brackets.
Trimming whitespace from the ends of a URI.


Doing those things in discreet steps would be cleaner. If you trim the string first, you won't need to look at the match results, only check whether there was a match. That means you can avoid the poor style used in the construct if (m=foo) without having to rewrite that part, and you can eliminate redundancy.

You could use encodeURI instead of throwing out URIs with certain characters; this way the user doesn't have to encode those characters before passing you the string.

s = s.trim();
if (s.match(/^https?:\/\/.*?\.(bmp|png|webp|gif|jpg|jpeg|svg)(\?.*)?$/)) {
    // looks like a path to an image
    return '&lt;img src="' + encodeURI(s) + '"&gt;';
}


If you are doing this on the client, consider creating an image element and returning that instead of returning a string.

s = s.trim();
if (s.match(/^https?:\/\/.*?\.(bmp|png|webp|gif|jpg|jpeg|svg)(\?.*)?$/)) {
    var img = new Image();
    img.src = encodeURI(s);
    return img;
}


Also, the regular expressions you are using and the one in this example will match things like http://lol.jpg; you may want to consider making it more strict.