title: Dangerous behavior disallowedcontent let me insert js in some case
body: <p>I'm trying to let my user can paste some html tag in their post by using ckeditor.</p>
  
  <p>But I have blacklisted some of them like <code>script</code> for example for avoiding XSS attack.</p>
  
  <p>Here is part of my config.js</p>
  
  <pre><code> '...'
      config.allowedContent = {
          $1: {
              elements: CKEDITOR.dtd,
              attributes: true,
              styles: true,
              classes: true
          }
      };
      config.disallowedContent = 'script;';
   '...'
  config.toolbar_mini = [
          { name: 'paragraph', groups: ['blocks', 'align', 'bidi' ], items: ['Blockquote', 'CreateDiv', '-', 'JustifyLeft', 'JustifyCenter', 'JustifyRight', 'JustifyBlock' ] },
          { name: 'styles', items: [ 'Font', 'FontSize' ] },
          { name: 'colors', items: [ 'TextColor', 'BGColor' ] },
          { name: 'basicstyles', groups: [ 'basicstyles', 'cleanup' ], items: [ 'Bold', 'Italic', 'Underline', 'Strike', '-', 'RemoveFormat' ] },
          { name: 'insert', items: [ 'Imgur', 'tliyoutube2', 'linkfile', 'Source'] },
      ];
  </code></pre>
  
  <p>When I click on <code>Source</code> for adding html tag and add
  <code>&lt;script&gt;alert('test')&lt;/script</code> then I click on <code>Source</code> for adding non-html content and submit my post. CKEDITOR will remove the <code>script</code> tag correctly as I expected.</p>
  
  <p>But if do the same:</p>
  
  <p>Click on <code>Source</code> then add my script tag
  <code>&lt;script&gt;alert('test')&lt;/script&gt;</code> and submit the post without being out of <code>Source</code> mode. The script is saved in my DB and executed.</p>
  
  <p>Also if I try to edit this message and go on <code>Source</code> mode CKEDITOR disable this <code>script</code> tag.</p>
  
  <p>Obviously I have to create validator on my backend for avoiding this. But I don't think this the correct behavior of <code>disallowedContent</code> or if it is then I don't understand why.</p>
  
  <p>Did I missconfigure my CKEDITOR or is it the correct behavior ?</p>