Exclude event attributes when rendering markdown

Closes gohugoio#9463
jmooring · Feb 4, 2022 · f80c042 · f80c042
1 parent 3336762
commit f80c042
Show file tree

Hide file tree

Showing 2 changed files with 54 additions and 1 deletion.
diff --git a/hugolib/content_render_hooks_test.go b/hugolib/content_render_hooks_test.go
@@ -497,3 +497,55 @@ disableKinds = ["page", "section", "taxonomy", "term"]
 	b.BuildE(BuildCfg{})
 	b.Assert(int(logger.LogCounters().WarnCounter.Count()), qt.Equals, 0)
 }
+
+func TestAttributeExclusion(t *testing.T) {
+	b := newTestSitesBuilder(t)
+
+	b.WithConfigFile("toml", `
+	[markup.goldmark.renderer]
+	unsafe = false
+	
+	[markup.goldmark.parser.attribute]
+	block = true
+	title = true
+	`)
+
+	b.WithTemplates("_default/single.html", "{{ .Content }}")
+
+	b.WithContent("p1.md", `---
+title: "p1"
+---
+## Heading {class="a" onclick="alert('heading')" linenos="inline"}
+
+> Blockquote
+{class="b" ondblclick="alert('blockquote')" LINENOS="inline"}
+
+~~~bash {id="c" onmouseover="alert('code fence')" linenos=true linenostart=2 hl_lines=[3] hl_style=dracula}
+javascript
+security
+issue
+~~~
+`,
+	)
+
+	b.Build(BuildCfg{})
+
+	b.AssertFileContent("public/p1/index.html", `
+<h2 class="a" id="heading">Heading</h2>
+<blockquote class="b"><p>Blockquote</p>
+</blockquote>
+<div class="highlight" id="c"><div style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
+<table style="border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;">
+<pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code><span style="margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2
+</span><span style="margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">3
+</span><span style="display:block;width:100%;background-color:#3d3f4a"><span style="margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">4
+</span></span></code></pre></td>
+<td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%">
+<pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">javascript
+security
+<span style="display:block;width:100%;background-color:#3d3f4a">issue
+</span></code></pre></td></tr></table>
+</div>
+</div>
+`)
+}
diff --git a/markup/goldmark/render_hooks.go b/markup/goldmark/render_hooks.go
@@ -161,7 +161,8 @@ func renderAttributes(w util.BufWriter, skipClass bool, attributes ...ast.Attrib
 			continue
 		}
 
-		if attributeExcludes[string(attr.Name)] {
+		a := strings.ToLower(string(attr.Name))
+		if attributeExcludes[a] || strings.HasPrefix(a, "on") {
 			continue
 		}