    util.sanitizeHTML(html)

Sanitize the provided HTML (string) to protect against XSS attacks. The algorithm has several steps:

- Wrap the provided HTML inside a `<div>` tag. This will remove tags that are invalid in that context (e.g. `<body>` and `<head>`).
- Parse the provided HTML in a new document context (using `jQuery.parseHTML()`). This prevents inline events from firing and also prevents image GET requests from being sent.
- Discard all `<script>` tags.
- Iterate through all DOM nodes and remove all `on...` attributes (e.g. `onload`, `onerror`).
- Iterate through all attributes of the nodes and remove all that use the `javascript:` pseudo-protocol as value.
- Return the sanitized HTML back as a string.

The six simple steps protect against the most common XSS attacks; however, we cannot guarantee bulletproof security here. If you need stronger security, you should always keep an eye on a list XSS attacks and replace the `joint.util.sanitizeHTML()` function with your own, more secure version.

Examples:

    joint.util.sanitizeHTML('<html><body><p>Hello</p></body></html>'); // => '<p>Hello</p>'
    joint.util.sanitizeHTML('<p>Hello</p><script>alert("Hacked");</script>'); // => '<p>Hello</p>'
    joint.util.sanitizeHTML('<p>Hello</p><img onload="alert(&quot;Hacked&quot;);">'); // => '<p>Hello</p><img>'
    joint.util.sanitizeHTML('<p>Hello</p><img src="javascript:alert(&quot;Hacked&quot;);">'); // => '<p>Hello</p><img>'