Repository: gohugoio/hugo (language: go)

Issue:
Exclude event attributes when rendering markdown
### Current Behavior

config.toml

```toml
[markup.goldmark.renderer]
unsafe = false

[markup.goldmark.parser.attribute]
block = true
title = true
```

markdown

````md
## Heading {onclick="alert('heading')"}

> Blockquote
{ondblclick="alert('blockquote')"}

```bash {onmouseover="alert('code fence')"}
codefences
```
````

renders

```html
<h2 onclick="alert('heading')" id="heading">Heading</h2>

<blockquote><p>Blockquote</p></blockquote>

<div class="highlight" onmouseover="alert('code fence')">...
```

### Desired Behavior

Remove attribute events from headings and code fences. The block attributes are already being sanitized.

```html
<h2 id="heading">Heading</h2>

<blockquote><p>Blockquote</p></blockquote>

<div class="highlight">...
```

Reference:
- <https://discourse.gohugo.io/t/35150/6>
- <https://discourse.gohugo.io/t/35069/4>

Testing:

```bash
git clone --single-branch -b hugo-github-issue-9463 https://github.com/jmooring/hugo-testing hugo-github-issue-9463
cd hugo-github-issue-9463
hugo server
```


Discussion / hints:

Fix patch:
diff --git a/.gitignore b/.gitignore
index 1b78398ccbd..b2aeb914241 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,4 @@ resources/sunset.jpg
 
 vendor
 
+.hugo_build.lock
diff --git a/markup/goldmark/render_hooks.go b/markup/goldmark/render_hooks.go
index 9e9ca197678..e6d959abfe7 100644
--- a/markup/goldmark/render_hooks.go
+++ b/markup/goldmark/render_hooks.go
@@ -161,7 +161,8 @@ func renderAttributes(w util.BufWriter, skipClass bool, attributes ...ast.Attrib
 			continue
 		}
 
-		if attributeExcludes[string(attr.Name)] {
+		a := strings.ToLower(string(attr.Name))
+		if attributeExcludes[a] || strings.HasPrefix(a, "on") {
 			continue
 		}
 


Test patch:
diff --git a/markup/goldmark/integration_test.go b/markup/goldmark/integration_test.go
new file mode 100644
index 00000000000..387d7be6649
--- /dev/null
+++ b/markup/goldmark/integration_test.go
@@ -0,0 +1,61 @@
+// Copyright 2021 The Hugo Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package goldmark_test
+
+import (
+	"testing"
+
+	"github.com/gohugoio/hugo/hugolib"
+)
+
+func TestAttributeExclusion(t *testing.T) {
+	t.Parallel()
+
+	files := `
+-- config.toml --
+[markup.goldmark.renderer]
+	unsafe = false
+[markup.goldmark.parser.attribute]
+	block = true
+	title = true
+-- content/p1.md --
+---
+title: "p1"
+---
+## Heading {class="a" onclick="alert('heading')" linenos="inline"}
+
+> Blockquote
+{class="b" ondblclick="alert('blockquote')" LINENOS="inline"}
+
+~~~bash {id="c" onmouseover="alert('code fence')"}
+foo
+~~~
+-- layouts/_default/single.html --
+{{ .Content }}
+`
+
+	b := hugolib.NewIntegrationTestBuilder(
+		hugolib.IntegrationTestConfig{
+			T:           t,
+			TxtarString: files,
+			NeedsOsFS:   false,
+		},
+	).Build()
+
+	b.AssertFileContent("public/p1/index.html", `
+<h2 class="a" id="heading">
+<blockquote class="b">
+<div class="highlight" id="c">
+	`)
+}