waylan/Python-Markdown — Issue #82: Safe mode *must* disallow attributes like "onload", "onclick"
Author: nomulous
Created: 2012-03-05 18:11:29+00:00
State: open

Possibly by disabling attributes altogether, or by applying a filter. There is a fairly comprehensive list at http://ha.ckers.org/xss.html#XSS_Event_handlers

This is the mode that people are expected to use when rendering user input. This has to be the default, especially since most people don't know about or use this attribute syntax in the first place. The output must be *actually guaranteed safe*, not just partly safe. This vulnerability is just as dangerous as `javascript:` links.

```
{@onclick=alert('hi')}some paragraph
```