Click 

Lets get on this like now...

ow_utilities/html_tag.php

Search for stripJs Function, which looks like this:

   stripJs  {        $tags = array('script');    /**     * Removes <script> tags and JS event handlers.     *     * @param string $text
     * @return string     */    public static function stripJs( $text )    {        $attrs = array(            'onchange',            'onclick',            'ondblclick',            'onerror',            'onfocus',            'onkeydown',            'onkeypress',            'onkeyup',            'onload',            'onmousedown',            'onmousemove',            'onmouseout',            'onmouseover',            'onmouseup',            'onreset',            'onselect',            'onsubmit',            'onunload');        $jevix = self::getJevix($tags, $attrs, true, false);        return $jevix->parse($text);    }

Add href attribute to be stripped before onunload:

            'href',

 so you have:

$attrs = array(            'onchange',            'onclick',            'ondblclick',            'onerror',            'onfocus',            'onkeydown',            'onkeypress',            'onkeyup',            'onload',            'onmousedown',            'onmousemove',            'onmouseout',            'onmouseover',            'onmouseup',            'onreset',            'onselect',            'onsubmit',            'href',            'onunload');

 This is the simplest and quickest way to mitigate this at the moment.

@Zach Jones : your solution is good for mitigation of this xss, but now it's impossible to put links in posts. Is there a way to block only the alert() function ?

Truthfully, I think we should be using the php functions htmlentities() or htmlspecialchars() to effectively and completely mitigate XSS, while identifying some of the most common attacks like alert and turning it around on them by alerting that the incident is being recorded and their IP address has been logged. We need a way for reporting XSS to the server side, so I'll look into that too.

https://paragonie.com/...ything-you-need-know

There are also evasions for our mitigation's so what ever they or we decide, we should be mindful of these: 
https://www.owasp.org/..._Evasion_Cheat_Sheet

but this will

because one has href="http://javascript:alert(document.domain)" and the other has href="javascript:alert(document.domain)"

Still, I would like to see something more comprehensive like: 

https://github.com/voku/anti-xss/

https://github.com/voku/anti-xss/blob/master/src/voku/helper/AntiXSS.php

To help prevent evasions, and href might not be the only attack vector.

I am looking into how phpBB3 handles these types of issues.

I have a other one : can't we just strip "javascript:" from any user input ? 

We can hide the link containing "javascript" with css :

div.post_content span.ow_ws_link a[href*="javascript"] {visibility:hidden;}

But this is really not a good solution, and there are other forms of xss... 

In overall however, to prevent XSS, one thing will be to sanitize every user input. This is done in most part of the application. So like using htmlspecialchars() or htmlentities() can prevent it because then <script> will be converted to prevent the XSS from occurring.

I have a discussion with my team tomorrow. I will check with them and as soon as we have more info, I will let you guys know. One of my team member is actually going through the source code and checking instance for the fix. If he fixes the XSS, I will post it here. 

Thank you, 

Securify Lab