Index: CRM/Utils/Rule.php
===================================================================
--- CRM/Utils/Rule.php  (revision 421)
+++ CRM/Utils/Rule.php  (working copy)
@@ -500,7 +500,15 @@
         return false;
     }

-    static function xssString( $value ) {
+    static function xssString( $value )
+    {
+        require_once 'htmlpurifier/library/HTMLPurifier.auto.php';
+        $purifier = new HTMLPurifier();
+        $clean_html = $purifier->purify( $value );
+        if ($clean_html != $value) {
+          return false;
+        }
+
         return preg_match( '!<(vb)?script[^>]*>.*</(vb)?script.*>!ims',
                            $value ) ? false : true;
     }