chriso/node-validator — Issue #51: xss() does not remove inline event handlers
Author: bigfish
Created: 2011-12-06 01:49:25+00:00
State: open

eg,

try me

the event handler does not get stripped out by xss()

although I could use entityEncode() as a workaround to prevent all HTML..

not sure if this is a bug or a documentation thing, I just assumed it should work.