You could just change the namespace. E.g., introduce a new namespace called "restricted-xhtml" that has a custom uri ("webodf:urn:restricted:xhtml"), and replace the script elements with namespaced equivalents. That would keep the content inline in the document, but stop the browser from treating it as a script and attempting execution.