diff --git a/www/common/media-tag.js b/www/common/media-tag.js index a50c22267..99eaa3307 100644 --- a/www/common/media-tag.js +++ b/www/common/media-tag.js @@ -575,6 +575,10 @@ var factory = function (Util) { Object.keys(origin.attributes).forEach(function (i) { if (!/^data-attr/.test(origin.attributes[i].name)) { return; } var name = origin.attributes[i].name.slice(10); + // Ignore attributes filtered out by the sanitizer + if (name === "src") { return; } + if (name === "srcdoc") { return; } + if (/^on/i.test(name)) { return; } var value = origin.attributes[i].value; dest.setAttribute(name, value); });