markup/goldmark: Exclude event attributes from markdown render hook

Fixes #9511

markup/goldmark/integration_test.go

@@ -20,6 +20,7 @@ import (
 	"github.com/gohugoio/hugo/hugolib"
 )
 
+// Issue 9463
 func TestAttributeExclusion(t *testing.T) {
 	t.Parallel()
 
@@ -61,6 +62,39 @@ foo
 	`)
 }
 
+// Issue 9511
+func TestAttributeExclusionWithRenderHook(t *testing.T) {
+	t.Parallel()
+
+	files := `
+-- content/p1.md --
+---
+title: "p1"
+---
+## Heading {onclick="alert('renderhook')" data-foo="bar"}
+-- layouts/_default/single.html --
+{{ .Content }}
+-- layouts/_default/_markup/render-heading.html --
+<h{{ .Level }}
+  {{- range $k, $v := .Attributes -}}
+    {{- printf " %s=%q" $k $v | safeHTMLAttr -}}
+  {{- end -}}
+>{{ .Text | safeHTML }}</h{{ .Level }}>
+`
+
+	b := hugolib.NewIntegrationTestBuilder(
+		hugolib.IntegrationTestConfig{
+			T:           t,
+			TxtarString: files,
+			NeedsOsFS:   false,
+		},
+	).Build()
+
+	b.AssertFileContent("public/p1/index.html", `
+		<h2 data-foo="bar" id="heading">Heading</h2>
+	`)
+}
+
 // Issue 9504
 func TestLinkInTitle(t *testing.T) {
 	t.Parallel()

markup/goldmark/render_hooks.go

@@ -57,6 +57,9 @@ func (a *attributesHolder) Attributes() map[string]string {
 	a.attributesInit.Do(func() {
 		a.attributes = make(map[string]string)
 		for _, attr := range a.astAttributes {
+			if strings.HasPrefix(string(attr.Name), "on") {
+				continue
+			}
 			a.attributes[string(attr.Name)] = string(util.EscapeHTML(attr.Value.([]byte)))
 		}
 	})