This is being used now, seems decent to me but I'm curious.     if (m=s.match(/^\s*(https?:\/\/[^\s<>]+)\.(bmp|png|webp|gif|jpg|jpeg|svg)\s*$/)) {          // example s: http://mustachify.me/?src=http://www.someImage.jpg        return '<img src='+m[1]+'.'+m[2]+'>';    }    if (m=s.match(/^\s*(https?:\/\/[^\s<>?]+)\.(bmp|png|webp|gif|jpg|jpeg|svg)(\?[^\s<>?]*)?\s*$/)) {        // example s: http://place.com/photo/something.jpg?height=600&modified_at=1384796271&ratio_x=03&ratio_y=02&width=900        return '<img src='+m[1]+'.'+m[2]+(m[3]||'')+'>';    }I've been trying to get around it but haven't yet managed it. So I'm thinking of just using this.
Is this `img` creator decently secure from XSS?
javascript;parsing;security;regex