'Sanitize a url against xss attacks in "safe_mode".
Rather than specifically blacklisting `javascript:alert("XSS")` and all
its aliases (see <http://ha.ckers.org/xss.html>), we whitelist known
safe url formats. Most urls contain a network location, however some
are known not to (i.e.: mailto links). Script urls do not contain a
location. Additionally, for `javascript:...`, the scheme would be
"javascript" but some aliases will appear to `urlparse()` to have no
scheme. On top of that relative links (i.e.: "foo/bar.html") have no
scheme. Therefore we must check "path", "parameters", "query" and
"fragment" for any literal colons. We don\'t check "scheme" for colons
because it *should* never have any and "netloc" must allow the form:
`username:password@host:port`.'

def sanitize_url(self, url):

    if (not self.markdown.safeMode):
        return url
    try:
        (scheme, netloc, path, params, query, fragment) = url = urlparse(url)
    except ValueError:
        return u''
    locless_schemes = [u'', u'mailto', u'news']
    allowed_schemes = (locless_schemes + [u'http', u'https', u'ftp', u'ftps'])
    if (scheme not in allowed_schemes):
        return u''
    if ((netloc == u'') and (scheme not in locless_schemes)):
        return u''
    for part in url[2:]:
        if (u':' in part):
            return u''
    return urlunparse(url)
