unless we are sure that we have an exhaustive list of sensitive html attributes I wouldn't even bother with this fix. the purpose of this check is to guide developers not to use data-binding with onclick and similar events and not to prevent attackers that can exploit server-side security holes from using data-binding as an attack vector.