The reason is that we match [^>] to find the end of the bad string, 
because this is the only safe match (end of tag). We can't match [^'"] 
because the offending attribute might not be closed with a quote.

Here it is.

Please provide a reproducible test case, such as something that can 
easily be dropped into the tests/ directory of the Horde_Text_Filter 
package.  I don't understand what your example is supposed to show.   
The preg in the previous comment is nowhere near the same as the preg 
contained in Xss.php.

The regex in case is a complex version of this one: 
'/(=|url\()("?)[^>]*script:/'



With this simplified version I tried 3 different tests and the results 
are quite inconsistent.



1- onclick='javascript:console.log("test");' - Works fine.

2- style="background: url('javascript:test()');" - Works fine.

3- Test 1 and 2 on the same element - Does not work.



NOTE: this bug occurs on previous versions of IMP too.

Sorry about that. Here it is:Horde/Text/Filter/Xss.php line:95

I don't see this.  And I don't know what regex you are referring to.

The "view.php?actionID=view_attach" link is not render anything when 
the attach is a HTML file.



The problem might be on the regex that remove 
"attribute="javascript:foo()". When this is preg is commented all work 
fine.