remove all on event attributes

lib/single-file/single-file-browser.js

@@ -123,6 +123,17 @@ this.SingleFile = this.SingleFile || (() => {
 			return doc;
 		}
 
+		static getOnEventAttributeNames(doc) {
+			const element = doc.createElement("div");
+			const attributeNames = [];
+			for (let propertyName in element) {
+				if (propertyName.startsWith("on")) {
+					attributeNames.push(propertyName);
+				}
+			}
+			return attributeNames;
+		}
+
 		static getParser() {
 			return DOMParser;
 		}

lib/single-file/single-file-core.js

@@ -251,6 +251,7 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 				pageContent = await Download.getContent(this.baseURI, { asDataURI: false, maxResourceSize: this.options.maxResourceSize, maxResourceSizeEnabled: this.options.maxResourceSizeEnabled });
 			}
 			this.doc = DOM.createDoc(pageContent, this.baseURI);
+			this.onEventAttributeNames = DOM.getOnEventAttributeNames(this.doc);
 			if (!pageContent && this.doc.querySelector("meta[name=fragment][content=\"!\"]") && !this.baseURI.endsWith("?" + ESCAPED_FRAGMENT) && !this.baseURI.endsWith("&" + ESCAPED_FRAGMENT)) {
 				await DOMProcessor.loadEscapedFragmentPage();
 			}
@@ -315,8 +316,10 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 			objectElements.forEach(element => element.remove());
 			const replacedAttributeValue = this.doc.querySelectorAll("link[rel~=preconnect], link[rel~=prerender], link[rel~=dns-prefetch], link[rel~=preload], link[rel~=prefetch]");
 			replacedAttributeValue.forEach(element => element.setAttribute("rel", element.getAttribute("rel").replace(/(preconnect|prerender|dns-prefetch|preload|prefetch)/g, "")));
-			this.doc.querySelectorAll("[onload]").forEach(element => element.removeAttribute("onload"));
-			this.doc.querySelectorAll("[onerror]").forEach(element => element.removeAttribute("onerror"));
+			this.doc.querySelectorAll("meta[http-equiv=\"content-security-policy\"").forEach(element => element.remove());
+			if (this.options.removeScripts) {
+				this.onEventAttributeNames.forEach(attributeName => this.doc.querySelectorAll("[" + attributeName + "]").forEach(element => element.removeAttribute(attributeName)));
+			}
 			if (this.options.removeAudioSrc) {
 				const audioSourceElements = this.doc.querySelectorAll("audio[src], audio > source[src]");
 				this.stats.set("discarded", "audioSource", audioSourceElements.length);