From f80c04280378045bee35f9cfc773b674c6316697 Mon Sep 17 00:00:00 2001
From: Joe Mooring <joe.mooring@veriphor.com>
Date: Thu, 3 Feb 2022 16:03:25 -0800
Subject: [PATCH] Exclude event attributes when rendering markdown

Closes #9463
---
 hugolib/content_render_hooks_test.go | 52 ++++++++++++++++++++++++++++
 markup/goldmark/render_hooks.go      |  3 +-
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/hugolib/content_render_hooks_test.go b/hugolib/content_render_hooks_test.go
index edfeaa82a81..7acd8849a3d 100644
--- a/hugolib/content_render_hooks_test.go
+++ b/hugolib/content_render_hooks_test.go
@@ -497,3 +497,55 @@ disableKinds = ["page", "section", "taxonomy", "term"]
 	b.BuildE(BuildCfg{})
 	b.Assert(int(logger.LogCounters().WarnCounter.Count()), qt.Equals, 0)
 }
+
+func TestAttributeExclusion(t *testing.T) {
+	b := newTestSitesBuilder(t)
+
+	b.WithConfigFile("toml", `
+	[markup.goldmark.renderer]
+	unsafe = false
+	
+	[markup.goldmark.parser.attribute]
+	block = true
+	title = true
+	`)
+
+	b.WithTemplates("_default/single.html", "{{ .Content }}")
+
+	b.WithContent("p1.md", `---
+title: "p1"
+---
+## Heading {class="a" onclick="alert('heading')" linenos="inline"}
+
+> Blockquote
+{class="b" ondblclick="alert('blockquote')" LINENOS="inline"}
+
+~~~bash {id="c" onmouseover="alert('code fence')" linenos=true linenostart=2 hl_lines=[3] hl_style=dracula}
+javascript
+security
+issue
+~~~
+`,
+	)
+
+	b.Build(BuildCfg{})
+
+	b.AssertFileContent("public/p1/index.html", `
+<h2 class="a" id="heading">Heading</h2>
+<blockquote class="b"><p>Blockquote</p>
+</blockquote>
+<div class="highlight" id="c"><div style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4">
+<table style="border-spacing:0;padding:0;margin:0;border:0;width:auto;overflow:auto;display:block;"><tr><td style="vertical-align:top;padding:0;margin:0;border:0;">
+<pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code><span style="margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">2
+</span><span style="margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">3
+</span><span style="display:block;width:100%;background-color:#3d3f4a"><span style="margin-right:0.4em;padding:0 0.4em 0 0.4em;color:#7f7f7f">4
+</span></span></code></pre></td>
+<td style="vertical-align:top;padding:0;margin:0;border:0;;width:100%">
+<pre tabindex="0" style="color:#f8f8f2;background-color:#282a36;-moz-tab-size:4;-o-tab-size:4;tab-size:4"><code class="language-bash" data-lang="bash">javascript
+security
+<span style="display:block;width:100%;background-color:#3d3f4a">issue
+</span></code></pre></td></tr></table>
+</div>
+</div>
+`)
+}
diff --git a/markup/goldmark/render_hooks.go b/markup/goldmark/render_hooks.go
index 9e9ca197678..e6d959abfe7 100644
--- a/markup/goldmark/render_hooks.go
+++ b/markup/goldmark/render_hooks.go
@@ -161,7 +161,8 @@ func renderAttributes(w util.BufWriter, skipClass bool, attributes ...ast.Attrib
 			continue
 		}
 
-		if attributeExcludes[string(attr.Name)] {
+		a := strings.ToLower(string(attr.Name))
+		if attributeExcludes[a] || strings.HasPrefix(a, "on") {
 			continue
 		}