commit 1271a5ea1bdce59045c8ddde138b88bc071886ac
Author: Joel Pittet <joel@pittet.ca>
Date:   Fri Sep 4 21:30:04 2015 -0700

    filter unsafe

diff --git a/core/lib/Drupal/Component/Utility/SafeMarkup.php b/core/lib/Drupal/Component/Utility/SafeMarkup.php
index 325f37a..280de7a 100644
--- a/core/lib/Drupal/Component/Utility/SafeMarkup.php
+++ b/core/lib/Drupal/Component/Utility/SafeMarkup.php
@@ -216,6 +216,7 @@ public static function checkPlain($text) {
    * @see t()
    */
   public static function format($string, array $args) {
+    $safe = TRUE;
     // Transform arguments before inserting them.
     foreach ($args as $key => $value) {
       switch ($key[0]) {
@@ -223,6 +224,7 @@ public static function format($string, array $args) {
           // Escaped only.
           if (!SafeMarkup::isSafe($value)) {
             $args[$key] = Html::escape($value);
+            $safe = FALSE;
           }
           break;
 
@@ -231,6 +233,7 @@ public static function format($string, array $args) {
           // Escaped and placeholder.
           if (!SafeMarkup::isSafe($value)) {
             $value = Html::escape($value);
+            $safe = FALSE;
           }
           $args[$key] = '<em class="placeholder">' . $value . '</em>';
           break;
@@ -239,13 +242,16 @@ public static function format($string, array $args) {
           // Try to preserve the value by only admin filtering if not marked
           // safe.
           if (!static::isSafe($value)) {
-            // XSS admin filtered.
-            $args[$key] = Xss::filterAdmin($value);
+            $safe = FALSE;
           }
       }
     }
 
     $output = strtr($string, $args);
+    if (!$safe) {
+      // XSS admin filtered.
+      $output = Xss::filterAdmin($output);
+    }
     static::$safeStrings[$output]['html'] = TRUE;
 
     return $output;
diff --git a/core/modules/system/src/Tests/Common/XssUnitTest.php b/core/modules/system/src/Tests/Common/XssUnitTest.php
index e822cd3..6601289 100644
--- a/core/modules/system/src/Tests/Common/XssUnitTest.php
+++ b/core/modules/system/src/Tests/Common/XssUnitTest.php
@@ -42,6 +42,9 @@ function testT() {
     $this->assertEqual($text, 'Placeholder text: <em class="placeholder">&lt;script&gt;</em>', 't replaces, escapes and themes string.');
     $text = t('Verbatim text: !value', array('!value' => '<script>'));
     $this->assertEqual($text, 'Verbatim text: ', 't XSS admin filters string.');
+    // Check bad protocol in attribute value.
+    $text = t('<a href="!value">Protocol stripped out<a>', array('!value' => "javascript:alert('red card')"));
+    $this->assertEqual($text, '<a href="alert(&#039;red card&#039;)">Protocol stripped out<a>', 't XSS admin filters unsafe attribute values.');
   }
 
   /**