CVE-2018-19787: Improper Neutralization of Input During Web Page Generation in LXML

The vulnerability stems from insufficient handling of encoded JavaScript URLs in the HTML sanitizer. The commit 6be1d08 shows the fix was applied to _remove_javascript_link by adding unquote_plus() to decode URLs before whitespace substitution. This function's pre-patch version only performed whitespace substitution without URL decoding, making it vulnerable to obfuscated 'javascript:' schemes. The test case changes in test_clean.txt demonstrate this was the attack vector. The function's direct responsibility for URL sanitization and the explicit patch confirm its vulnerability.