[FIXED SECURITY-67] Forbid CSS links in markup to be on the safe side.

core/src/main/java/hudson/markup/MyspacePolicy.java

@@ -67,7 +67,6 @@ public class MyspacePolicy {
             tag("img",      "src",ONSITE_OR_OFFSITE_URL,
                             "hspace","vspace");
             tag("iframe",   "src");
-            tag("link",     "type","rel");
             tag("ul,ol,li,dd,dl,dt,thead,tbody,tfoot");
             tag("table",    "noresize");
             tag("td,th,tr");

core/src/test/java/hudson/markup/MyspacePolicyTest.java

@@ -43,7 +43,7 @@ public class MyspacePolicyTest extends Assert {
         assertReject("script","<script src='relative.js'></script>");
 
         assertIntact("<style>H1 { display:none; }</style>");
-        assertIntact("<link rel='stylesheet' type='text/css' href='http://www.microsoft.com/'>");
+        assertReject("link", "<link rel='stylesheet' type='text/css' href='http://www.microsoft.com/'>");
         assertIntact("<div style='background-color:white'>inline CSS</div>");
         assertIntact("<br><hr>");