jquery/jquery — pull request #1508 by fhemberger (2014-02-02 13:18:11+00:00)
Title: jQuery.parseHTML: Disable inline event handlers when removing scripts

When removing script tags from the parsed result, inline event handlers should
be removed as well. It would be very insecure to create a blacklist of
event handler attributes, in case of one being forgotten or new handlers
being added in the future.

Therefore, all attributes starting with `on*` should be replaced by a data
attribute of the same name. All code which might exist can still be accessed,
but is not executed after being injected into the DOM to avoid possible XSS
attacks.

See also PR #1505.