Ticket #8630: 8630_2.patch

_source/plugins/htmldataprocessor/plugin.js

@@ -516 +516 @@
                         // Call the browser to help us fixing a possibly invalid HTML
                         // structure.
                         var div = new CKEDITOR.dom.element( 'div' );
+
+                        // Prevent execution of event handlers in the div (#8630)
+                        data = data.replace( /\bon/g, ' data-ckeoff' );
+
                         // Add fake character to workaround IE comments bug. (#3801)
                         div.setHtml( 'a' + data );
                         data = div.getHtml().substr( 1 );
 
+                        // Restore event handlers (#8630)
+                        data = data.replace( / data-ckeoff/g, ' on' );
+
                         // Unprotect "some" of the protected elements at this point.
                         data = unprotectElementNames( data );