¶ HTML onerror
partically fixed, but still available on editor...
¶ Markdown onerror
partically fixed, but
still availableon editor... Fixed #1251
{onerror="alert('xss2')"}
¶ HTML script // not hit
<script>alert('xss3')</script>