Mhm, are this the only blocked attributes? - There are [*a lot* more](https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Event_Handlers) event handlers in JS :-(