Exclude event attributes when rendering markdown

[jmooring]

Current Behavior

config.toml

[markup.goldmark.renderer]
unsafe = false

[markup.goldmark.parser.attribute]
block = true
title = true

markdown

## Heading {onclick="alert('heading')"}

> Blockquote
{ondblclick="alert('blockquote')"}

```bash {onmouseover="alert('code fence')"}
codefences
```

renders

<h2 onclick="alert('heading')" id="heading">Heading</h2>

<blockquote><p>Blockquote</p></blockquote>

<div class="highlight" onmouseover="alert('code fence')">...

Desired Behavior

Remove attribute events from headings and code fences. The block attributes are already being sanitized.

<h2 id="heading">Heading</h2>

<blockquote><p>Blockquote</p></blockquote>

<div class="highlight">...

Reference:

• https://discourse.gohugo.io/t/35150/6
• https://discourse.gohugo.io/t/35069/4

Testing:

git clone --single-branch -b hugo-github-issue-9463 https://github.com/jmooring/hugo-testing hugo-github-issue-9463
cd hugo-github-issue-9463
hugo server

[github-actions]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.