I'm not sure what this is saying. If it's talking about things the browser can be made to do my response is "so? that's intentional".
If it's about things that can happen if you embed user (read: attacker) provided content in your page then you have already lost. There's never a time that you can safely embed content from an untrusted source in your page - no blacklist or whitelist based approach to content is going to be safe. The correct approach to user provided content is to parse the content, drop anything you don't understand or recognize exactly. Then escape all of the left over content, and reconstruct at the end.
You could use markdown to do this for you, or you could do it manually if you want you own rules (and/or -like syntax).
Filtering content is just not sound and every time I see something that seems to imply that it is, it makes me cry.
(A example of this taken to its extreme is WebGL shader parsing. A correct + "safe" implementation of WebGL must at the very least:
1. parse the shader itself, dropping all comments, etc
2. perform strict semantic analysis on the result of (especially as many GL drivers don't)
3. take the result of and turn that back into text
4. throw the result of at the gl engine
This is necessary to ensure that not only is the shader correct (in the terms of webgl), but also to ensure that no parsing oddities can get through (e.g. something seen as a comment terminator in the driver but not the validator - bugs like this have happened with multiple validators in multiple contexts over the last few decades)