Remove replaceEntities from validateLink

Entities will usually be replaced with unescapeAll before they
go through the validator.

lib/index.js

@@ -21,14 +21,12 @@ var config = {
 };
 
 
-var replaceEntities = require('./common/utils').replaceEntities;
 var BAD_PROTOCOLS   = [ 'vbscript', 'javascript', 'file' ];
 
 function validateLink(url) {
-  // Care about digital entities "javascript:alert(1)"
-  var str = replaceEntities(url);
-
-  str = str.trim().toLowerCase();
+  // url should be normalized at this point, and existing entities are decoded
+  //
+  var str = url.trim().toLowerCase();
 
   if (str.indexOf(':') >= 0 && BAD_PROTOCOLS.indexOf(str.split(':')[0]) >= 0) {
     return false;

test/fixtures/markdown-it/xss.txt

@@ -31,10 +31,13 @@ Should not allow some protocols in links and images
 [xss link](Javascript:alert(1))
 
 [xss link](Javascript:alert(1))
+
+[xss link](\Javascript:alert(1))
 .
 <p><a href="%22%3E%3Cscript%3Ealert(%22xss%22)%3C/script%3E">xss link</a></p>
 <p>[xss link](Javascript:alert(1))</p>
-<p>[xss link](&amp;#74;avascript:alert(1))</p>
+<p><a href="&amp;#74;avascript:alert(1)">xss link</a></p>
+<p><a href="&amp;#74;avascript:alert(1)">xss link</a></p>
 .
 
 .