flowchart's link may leads to XSS attack

```flowchart
st=>start: Start:>javascript:alert(document.domain)
e=>end:>javascript:alert(document.domain)
st->e
`````

If you click the node, javascript will be executed, which leads to XSS attack

No source file or test is named. Reproduce the reported flowchart input, trace how node links are generated and activated, and add coverage showing that javascript links cannot execute while supported links retain their intended behavior.

索引モデルが issue の本文から書いたものです。