remove scr attributes containing JS

lib/single-file/single-file-core.js

@@ -320,6 +320,16 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 			this.doc.querySelectorAll("a[ping]").forEach(element => element.removeAttribute("ping"));
 			if (this.options.removeScripts) {
 				this.onEventAttributeNames.forEach(attributeName => this.doc.querySelectorAll("[" + attributeName + "]").forEach(element => element.removeAttribute(attributeName)));
+				this.doc.querySelectorAll("[href]").forEach(element => {
+					if (element.href.match(/^\s*javascript:/)) {
+						element.removeAttribute("href");
+					}
+				});
+				this.doc.querySelectorAll("[src]").forEach(element => {
+					if (element.src.match(/^\s*javascript:/)) {
+						element.removeAttribute("src");
+					}
+				});
 			}
 			if (this.options.removeAudioSrc) {
 				const audioSourceElements = this.doc.querySelectorAll("audio[src], audio > source[src]");
@@ -388,9 +398,6 @@ this.SingleFileCore = this.SingleFileCore || (() => {
 					if (!match || match[1] != this.baseURI) {
 						element.setAttribute("href", href);
 					}
-					if (this.options.removeScripts && href.match(/^\s*javascript:/)) {
-						element.removeAttribute("href");
-					}
 				}
 			});
 		}