[shadow] Javascript injection

[trentm]

_This is a _shadow issue* for Issue 30 on Google Code (from which this project was moved).
Added 2009-09-29T17:29:09.000Z by c2531...@tyldd.com. Closed (Fixed).
Labels: Type-Defect, Priority-Critical.
Please make updates to the bug there.*

Original description

Quotation marks are not filtered from attributes, you can inject javascript
events into elements. Here is an example:

from markdown2 import markdown
test = """
![a][b]
[b]: http://static.reddit.com/reddit.com.header.png"
onload="alert('javascript injected')
"""
print markdown(test, safe_mode=True)

The result is:
<p><img src=&quot;http://static.reddit.com/reddit.com.header.png&quot;
onload=&quot;alert('javascript injected')&quot; alt=&quot;a&quot; /></p>

Expected result is:
<p><img src=&quot;http://static.reddit.com/reddit.com.header.png&quot;
onload=&quot;alert('javascript injected')&quot; alt=&quot;a&quot; /></p>