"data-cke-saved-src" is inserted and corrupt the source

[usami]

1. At the Demo site, put image and enter following text to Alternative Text in Image Properties.

    >"'><img src="javascript:alert('Test')">
   

2. Go to source mode and switch back to wysiwyg mode.
3. Open Image Properties and see the Alternative Text. It became like following.

   >"'><img  data-cke-saved-src="javascript:alert( src="javascript:alert('Test')">
   

This issue is similar to this ticket (​http://dev.ckeditor.com/ticket/7243), but still causing on CKEditor 3.6.2. and Demo site.

[Jakub Ś]

The above TC can be reproduced from CKEditor 3.0 but a single change (text doesn’t grow rapidly when switching modes) from

 >"'><img src="javascript:alert('Test')">

to

>"'><img  data-cke-saved-src="javascript:alert( src="javascript:alert('Test')">

can be observed from CKEditor 3.4.1

[Piotrek Koszuliński]

I cannot reproduce this any more.