I have to admit that I had a bit of trouble tracking down what this was doing as there are whitelist references in both this and the default.

What about a html attribute white and black list option in the core implementation? This way the code is only implemented once and the logic is localized to one place.