Rendering of "onclick" and other "on..." events changed

The example input

(% onclick="window.alert('hi')" style="cursor:pointer" title="click me" %)(((This shows a **Alert Box**)))

rendered in XWiki 14 to

   <div onclick="window.alert('hi')" style="cursor:pointer" title="click me"><p>This shows a <strong>Alert Box</strong></p></div>

with XWiki 17.2 (at least) it will be rendered to

 <div data-xwiki-translated-attribute-onclick="window.alert('hi')" style="cursor:pointer" title="click me"><p>This shows a <strong>Alert Box</strong></p></div>

This means the HTML attribute onclick will result into “data-xwiki-translated-attribute-onclick

This makes it very difficult to generate “clickable” structures like tables or full paragraphs.
A workaround with {{html clean=“false”}} is very complicated if more than a few words should be clickable.

As other attributes like onhover are effected too - can the old behavior reactivated / configured?

Some forms of our visualisations based on… events no longer work. I need some usable workaround/configuration - otherwise our upgrade plans are delayed further. (Our production system is still 13 due to problems with Postscript Exports. These seem to have been resolved in version 17.)

Hi,

this change has been done on purpose as part of Loading... to protect against possible XSS attacks. That being said it’s possible to specify a custom list of attributes to not sanitized as documented in https://extensions.xwiki.org/xwiki/bin/view/Extension/XML%20Module