several changes:

- added tests for all 4 cases: output to string or into element vs first param contains link or not
- cleaned up logic - skip HTML entity encoding only if we can ensure insertion to text node / when output to string, we always encode
- DOMpurify sanitizes gopher, ws & wss links, which we previosly had tested for

js/test/AttachmentViewer.js

@@ -88,7 +88,7 @@ describe('AttachmentViewer', function () {
                 if (prefix.indexOf('<a') === -1 && postfix.indexOf('<a') === -1) {
                     result = $.PrivateBin.Helper.htmlEntities(prefix + filename + postfix);
                 } else {
-                    result = $('<div>').html(prefix + $.PrivateBin.Helper.htmlEntities(filename) + postfix).html();
+                    result = prefix + $.PrivateBin.Helper.htmlEntities(filename) + postfix;
                 }
                 if (filename.length) {
                     results.push(