diff --git a/modules/filter/filter.module b/modules/filter/filter.module index e603b254..30f442bd 100644 --- a/modules/filter/filter.module +++ b/modules/filter/filter.module @@ -1116,7 +1116,13 @@ function _filter_xss_attributes($attr) { // Attribute name, href for instance if (preg_match('/^([-a-zA-Z]+)/', $attr, $match)) { $attrname = strtolower($match[1]); - $skip = ($attrname == 'style' || substr($attrname, 0, 2) == 'on'); + $skip = ( + $attrname == 'style' || + substr($attrname, 0, 2) == 'on' || + substr($attrname, 0, 1) == '-' || + // Ignore long attributes to avoid unnecessary processing overhead. + strlen($attrname) > 96 + ); $working = $mode = 1; $attr = preg_replace('/^[-a-zA-Z]+/', '', $attr); }