New Twiddle

components.my-component.js

import Ember from 'ember';
import hbs from 'htmlbars-inline-precompile';

export default Ember.Component.extend({
  layout: hbs`
    <a href={{attrs.input}}>CLICK</a>
  `
});

controllers.application.js

import Ember from 'ember';

export default Ember.Controller.extend({
  userInput: "javascript:alert('1')"
});

templates.application.hbs

<h1>Ember XSS PoC</h1>
<p>Ember escapes input and prevents XSS</p>

Enter string to be injected: 
{{input type="text" value=userInput}}<br />
{{my-component input=userInput}}

twiddle.json

{
  "version": "0.12.1",
  "EmberENV": {
    "FEATURES": {}
  },
  "options": {
    "use_pods": false,
    "enable-testing": false
  },
  "dependencies": {
    "jquery": "https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.js",
    "ember": "2.12.0",
    "ember-template-compiler": "2.12.0",
    "ember-testing": "2.12.0"
  },
  "addons": {
    "ember-data": "2.12.1"
  }
}