title: XSS - Which HTML Tags and Attributes can trigger Javascript Events?
body: <p>I'm trying to code a secure and lightweight white-list based HTML purifier which will use DOMDocument. In order to avoid unnecessary complexity I am willing to make the following compromises:</p>
  
  <ul>
  <li>HTML comments are removed</li>
  <li><code>script</code> and <code>style</code> tags are stripped all together</li>
  <li>only the child nodes of the <code>body</code> tag will be returned</li>
  <li>all HTML attributes that can trigger Javascript events will either be validated or removed</li>
  </ul>
  
  <p>I've been reading a lot about on XSS attacks and prevention and I hope I'm not being too naive (if I am, please let me know!) in assuming that if I follow all the rules I mentioned above, I will be safe from XSS.</p>
  
  <p>The problem is I am not sure what other tags and attributes (in any [X]HTML version and/or browser versions/implementations) can trigger Javascript events, besides the <a href="https://files.pbworks.com/download/f3ZPrKJwce/webappsec/13247042/ScriptMapping_Release_26Nov2007.html" rel="noreferrer">default Javascript event attributes</a>:</p>
  
  <ul>
  <li><code>onAbort</code></li>
  <li><code>onBlur</code></li>
  <li><code>onChange</code></li>
  <li><code>onClick</code></li>
  <li><code>onDblClick</code></li>
  <li><code>onDragDrop</code></li>
  <li><code>onError</code></li>
  <li><code>onFocus</code></li>
  <li><code>onKeyDown</code></li>
  <li><code>onKeyPress</code></li>
  <li><code>onKeyUp</code></li>
  <li><code>onLoad</code></li>
  <li><code>onMouseDown</code></li>
  <li><code>onMouseMove</code></li>
  <li><code>onMouseOut</code></li>
  <li><code>onMouseOver</code></li>
  <li><code>onMouseUp</code></li>
  <li><code>onMove</code></li>
  <li><code>onReset</code></li>
  <li><code>onResize</code></li>
  <li><code>onSelect</code></li>
  <li><code>onSubmit</code></li>
  <li><code>onUnload</code></li>
  </ul>
  
  <p>Are there any other non-default or proprietary event attributes that can trigger Javascript (or VBScript, etc...) events or code execution? I can think of <code>href</code>, <code>style</code> and <code>action</code>, for instance:</p>
  
  <pre><code>&lt;a href="javascript:alert(document.location);"&gt;XSS&lt;/a&gt; // or
  &lt;b style="width: expression(alert(document.location));"&gt;XSS&lt;/b&gt; // or
  &lt;form action="javascript:alert(document.location);"&gt;&lt;input type="submit" /&gt;&lt;/form&gt;
  </code></pre>
  
  <p>I will probably just remove any <code>style</code> attributes in the HTML tags, the <code>action</code> and <code>href</code> attributes pose a bigger challenge but I think the following code is enough to make sure their value is either a relative or absolute URL and not some nasty Javascript code:</p>
  
  <pre><code>$value = $attribute-&gt;value;
  
  if ((strpos($value, ':') !== false) &amp;&amp; (preg_match('~^(?:(?:s?f|ht)tps?|mailto):~i', $value) == 0))
  {
      $node-&gt;removeAttributeNode($attribute);
  }
  </code></pre>
  
  <p>So, my two obvious questions are:</p>
  
  <ol>
  <li><strong>Am I missing any tags or attributes that can trigger events?</strong></li>
  <li><strong>Is there any attack vector that is not covered by these rules?</strong></li>
  </ol>
  
  <hr>
  
  <p>After a lot of testing, pondering and researching I've come up with the <a href="https://github.com/alixaxel/phunction/blob/ca71da3ea7b132a44132a6166e2b722098b22d25/_.php#L1781" rel="noreferrer">following (rather simple) implementation</a> which, appears to be immune to any XSS attack vector I could throw at it.</p>
  
  <p>I highly appreciate all your valuable answers, thanks.</p>