Exclude event attributes when rendering markdown

Closes #9463

diff --git a/.gitignore b/.gitignore
index 1b78398ccbd85242737eadaddb2bf9745f831bf8..b2aeb914241c926f6f55b35ee2d13fa1ce2dc804 100644 (file)
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,4 @@ resources/sunset.jpg
 
 vendor
 
+.hugo_build.lock

diff --git a/markup/goldmark/integration_test.go b/markup/goldmark/integration_test.go
new file mode 100644 (file)
index 0000000..387d7be
--- /dev/null
+++ b/markup/goldmark/integration_test.go
@@ -0,0 +1,61 @@
+// Copyright 2021 The Hugo Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package goldmark_test
+
+import (
+       "testing"
+
+       "github.com/gohugoio/hugo/hugolib"
+)
+
+func TestAttributeExclusion(t *testing.T) {
+       t.Parallel()
+
+       files := `
+-- config.toml --
+[markup.goldmark.renderer]
+       unsafe = false
+[markup.goldmark.parser.attribute]
+       block = true
+       title = true
+-- content/p1.md --
+---
+title: "p1"
+---
+## Heading {class="a" onclick="alert('heading')" linenos="inline"}
+
+> Blockquote
+{class="b" ondblclick="alert('blockquote')" LINENOS="inline"}
+
+~~~bash {id="c" onmouseover="alert('code fence')"}
+foo
+~~~
+-- layouts/_default/single.html --
+{{ .Content }}
+`
+
+       b := hugolib.NewIntegrationTestBuilder(
+               hugolib.IntegrationTestConfig{
+                       T:           t,
+                       TxtarString: files,
+                       NeedsOsFS:   false,
+               },
+       ).Build()
+
+       b.AssertFileContent("public/p1/index.html", `
+<h2 class="a" id="heading">
+<blockquote class="b">
+<div class="highlight" id="c">
+       `)
+}

diff --git a/markup/goldmark/render_hooks.go b/markup/goldmark/render_hooks.go
index 9e9ca197678c7e25eb67da8cccd74403136f3879..e6d959abfe7fac3df08dd1e736415e6f162f22f8 100644 (file)
--- a/markup/goldmark/render_hooks.go
+++ b/markup/goldmark/render_hooks.go
@@ -161,7 +161,8 @@ func renderAttributes(w util.BufWriter, skipClass bool, attributes ...ast.Attrib
                        continue
                }
 
-               if attributeExcludes[string(attr.Name)] {
+               a := strings.ToLower(string(attr.Name))
+               if attributeExcludes[a] || strings.HasPrefix(a, "on") {
                        continue
                }