Function expectNoEventHandlerAttrs

test/jasmine/tests/toimage_test.js:283–294

(svg)

        const parser = new DOMParser();

        const expectNoEventHandlerAttrs = (svg) => {
            const doc = parser.parseFromString(svg, 'image/svg+xml');
            const nodes = doc.getElementsByTagName('*');
            for (const el of nodes) {
                for (const attr of el.attributes) {
                    const name = attr.name.toLowerCase();
                    if (name.startsWith('on')) {
                        fail(`parsed SVG has event-handler attribute <${el.nodeName} ${name}="${attr.value}">`);
                    }
                }
            }
        };

        const runXssCase = (payload, done) => {
            const fig = {