Add support for forbidding attributes, with default ban list of Javascript events.

Closes #1

config.go

@@ -20,6 +20,8 @@ type Config struct {
 	BadTags            []string
 	BadTagsMap         map[string]bool
 	BadDomains         []string
+	BadAttrs           []string
+	BadAttrsMap        map[string]bool
 }
 
 func getConfig(filename string) (Config, error) {
@@ -59,6 +61,80 @@ func getConfig(filename string) (Config, error) {
 		"script",
 	}
 
+	config.BadAttrs = []string{
+		"onabort",
+		"onafterprint",
+		"onbeforeprint",
+		"onbeforeunload",
+		"onblur",
+		"oncanplay",
+		"oncanplaythrough",
+		"onchange",
+		"onclick",
+		"oncontextmenu",
+		"oncopy",
+		"oncuechange",
+		"oncut",
+		"ondblclick",
+		"ondrag",
+		"ondragend",
+		"ondragenter",
+		"ondragleave",
+		"ondragover",
+		"ondragstart",
+		"ondrop",
+		"ondurationchange",
+		"onemptied",
+		"onended",
+		"onerror",
+		"onfocus",
+		"onhashchange",
+		"oninput",
+		"oninvalid",
+		"onkeydown",
+		"onkeypress",
+		"onkeyup",
+		"onload",
+		"onloadeddata",
+		"onloadedmetadata",
+		"onloadstart",
+		"onmessage",
+		"onmousedown",
+		"onmousemove",
+		"onmouseout",
+		"onmouseover",
+		"onmouseup",
+		"onmousewheel",
+		"onoffline",
+		"ononline",
+		"onpagehide",
+		"onpageshow",
+		"onpaste",
+		"onpause",
+		"onplay",
+		"onplaying",
+		"onpopstate",
+		"onprogress",
+		"onratechange",
+		"onreset",
+		"onresize",
+		"onscroll",
+		"onsearch",
+		"onseeked",
+		"onseeking",
+		"onselect",
+		"onstalled",
+		"onstorage",
+		"onsubmit",
+		"onsuspend",
+		"ontimeupdate",
+		"ontoggle",
+		"onunload",
+		"onvolumechange",
+		"onwaiting",
+		"onwheel",
+	}
+
 	config.BadDomains = []string{
 		"facebook.com",
 		"google.com",
@@ -77,6 +153,7 @@ func getConfig(filename string) (Config, error) {
 
 	// Build maps from lists
 	config.BadTagsMap = sliceToMap(config.BadTags)
+	config.BadAttrsMap = sliceToMap(config.BadAttrs)
 	config.BadMimesMap = sliceToMap(config.BadMimes)
 
 	// Done

htmlinspect.go

@@ -23,6 +23,10 @@ func ValidateHtml(config Config, n *html.Node, depth int, imgcount *int) (bool,
 			return false, "HTML document contains more than " + strconv.Itoa(config.MaxImages) + " images."
 		}
 		for _, a := range n.Attr {
+			_, ok := config.BadAttrsMap[a.Key]
+			if ok {
+			return false, "HTML document contains <" + n.Data + "> tag with forbiden attribute: " + a.Key
+			}
 			if a.Key == "src" && strings.Contains(a.Val, "://") {
 				return false, "HTML document includes <" + n.Data + "> tag with a remote src"
 			}