<i>The point for such scenarios is that whitelist is better than blacklist.</i><p>from CVE-2015-7580:<p><i>Carefully crafted strings can cause user input to bypass the sanitization in the white list sanitizer</i><p>So people are using a whitelist, and this bug is in that whitelist.  In other words, people are &quot;doing the right thing&quot; and are still vulnerable.