filter onevent attributes

erusev · May 1, 2017 · 131ba75 · 131ba75
1 parent af04ac9
commit 131ba75
Showing 1 changed file with 16 additions and 0 deletions.
diff --git a/Parsedown.php b/Parsedown.php
@@ -1513,6 +1513,22 @@ protected function sanitiseElement(array $Element)
             $Element = $this->filterUnsafeUrlInAttribute($Element, $safeUrlNameToAtt[$Element['name']]);
         }
 
+        if ( ! empty($Element['attributes']))
+        {
+            # clear out nulls
+            $Element['attributes'] = array_filter(
+                $Element['attributes'],
+                function ($v) {return $v !== null;}
+            );
+
+            $onEventAttributes = preg_grep('/^\s*+on/i', array_flip($Element['attributes']));
+
+            foreach ($onEventAttributes as $att)
+            {
+                unset($Element['attributes'][$att]);
+            }
+        }
+
         return $Element;
     }