<telerik:RadEditor runat="server" ID="RadEditor1" Height="600px" OnClientModeChange="OnClientModeChange" ContentFilters="DefaultFilters,StripDomEventAttributes">
            <Content>
            </Content>
            <Modules>
                <telerik:EditorModule Name="RadEditorStatistics" Visible="true" />
                <telerik:EditorModule Name="RadEditorDomInspector" Visible="true" />
                <telerik:EditorModule Name="RadEditorNodeInspector" Visible="false" />
                <telerik:EditorModule Name="RadEditorHtmlInspector" Visible="true" />
            </Modules>
        </telerik:RadEditor>

        <script type="text/javascript">
            function OnClientModeChange(editor, args) {
                // Check if the editor is switching to Html mode (mode 2)
                if (editor.get_mode() === 2) {
                    var textArea = editor.get_textArea();
                    if (textArea) {
                        // Attach the paste event handler to the textarea
                        textArea.addEventListener('paste', handlePaste);
                        // Attach the keydown event handler to the textarea
                        textArea.addEventListener('keydown', handleKeydown);
                    }
                } else {
                    // Clean up the event listeners when switching away from Html mode
                    var textArea = editor.get_textArea();
                    if (textArea) {
                        textArea.removeEventListener('paste', handlePaste);
                        textArea.removeEventListener('keydown', handleKeydown);
                    }
                }
            }

            function sanitizeHtmlAttributes(html) {
                // Remove on... event attributes (e.g., onload, onclick, etc.)
                return html.replace(/\s+on\w+\s*=\s*(['"]?)[^ >]*\1/gi, "");
            }

            function handlePaste(event) {
                event.preventDefault();
                var clipboardData = event.clipboardData || window.clipboardData;
                var pastedData = clipboardData.getData('text/plain');
                var sanitizedData = sanitizeHtmlAttributes(pastedData);
                document.execCommand('insertText', false, sanitizedData);
            }

            function handleKeydown(event) {
                // Use setTimeout to wait for the value to update after the key press
                var textArea = event.target;
                setTimeout(function () {
                    var sanitized = sanitizeHtmlAttributes(textArea.value);
                    if (sanitized !== textArea.value) {
                        var pos = textArea.selectionStart;
                        textArea.value = sanitized;
                        // Optionally, restore cursor position
                        textArea.setSelectionRange(pos, pos);
                    }
                }, 0);
            }
        </script>

          <telerik:RadEditor runat="server" ID="RadEditor1" Height="600px" OnClientModeChange="OnClientModeChange" ContentFilters="DefaultFilters,StripDomEventAttributes">
              <Content>
              </Content>
            <Modules>
                <telerik:EditorModule Name="RadEditorStatistics" Visible="true" />
                <telerik:EditorModule Name="RadEditorDomInspector" Visible="true" />
                <telerik:EditorModule Name="RadEditorNodeInspector" Visible="false" />
                <telerik:EditorModule Name="RadEditorHtmlInspector" Visible="true" />
            </Modules>
        </telerik:RadEditor>

        <script type="text/javascript">
            function OnClientModeChange(editor, args) {
                // Check if the editor is switching to Html mode (mode 2)
                if (editor.get_mode() === 2) {
                    var textArea = editor.get_textArea();
                    if (textArea) {
                        // Attach the paste event handler to the textarea
                        textArea.addEventListener('paste', handlePaste);
                    }
                } else {
                    // Clean up the event listener when switching away from Html mode
                    var textArea = editor.get_textArea();
                    if (textArea) {
                        textArea.removeEventListener('paste', handlePaste);
                    }
                }
            }

            function handlePaste(event) {
                // Prevent the default paste action to take control
                event.preventDefault();

                // Get the plain text content from the clipboard
                var clipboardData = event.clipboardData || window.clipboardData;
                var pastedData = clipboardData.getData('text/plain');

                // Sanitize the pasted data by removing on... event attributes
                var sanitizedData = pastedData.replace(/\s+on\w+\s*=\s*[^ >]+/gi, "");

                // Use execCommand to insert the sanitized text.
                // This is a reliable way to handle pasting in content-editable areas and textareas.
                document.execCommand('insertText', false, sanitizedData);
            }
        </script>

        <telerik:RadEditor runat="server" ID="RadEditor1" Height="600px" ContentFilters="DefaultFilters,StripDomEventAttributes">
            <Content>
        <svg
onload=alert(1)><svg> # newline char
<svg	onload=alert(1)><svg> # tab char
<svgonload=alert(1)><svg> # new page char (0xc)
            </Content>
            <Modules>
                <telerik:EditorModule Name="RadEditorStatistics" Visible="true" />
                <telerik:EditorModule Name="RadEditorDomInspector" Visible="true" />
                <telerik:EditorModule Name="RadEditorNodeInspector" Visible="false" />
                <telerik:EditorModule Name="RadEditorHtmlInspector" Visible="true" />
            </Modules>
        </telerik:RadEditor>

    protected void Page_Load(object sender, EventArgs e)
    {
            string content = RadEditor1.Content;

            // Regular expression to identify 'javascript:' in `to` and `href` attributes within SVG elements
            string pattern = @"(<(set|animate|brute)[^>]*?\s(?:to|href)\s*=\s*['""]?)javascript:[^'""]*";

            // Replace occurrences of 'javascript:' with an empty string
            content = System.Text.RegularExpressions.Regex.Replace(content, pattern, "$1", System.Text.RegularExpressions.RegexOptions.IgnoreCase);

            // Assign the sanitized content back to the editor
            RadEditor1.Content = content;
    }

Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs)
    ' Get the content from RadEditor
    Dim content As String = RadEditor1.Content

    ' Regular expression to identify 'javascript:' in `to` and `href` attributes within SVG elements
    Dim pattern As String = "(<(set|animate|brute)[^>]*?\s(?:to|href)\s*=['""]?)javascript:[^'""]*"

    ' Replace occurrences of 'javascript:' with an empty string
    content = System.Text.RegularExpressions.Regex.Replace(content, pattern, "$1", System.Text.RegularExpressions.RegexOptions.IgnoreCase)

    ' Assign the sanitized content back to the editor
    RadEditor1.Content = content
End Sub

    protected void Page_Load(object sender, EventArgs e)
    {
        string content = RadEditor1.Content;

        // Matches tags and attributes that can potentially execute JavaScript
        string pattern = @"(<([a-zA-Z0-9]+)[^>]*?\s(?:to|href|xlink:href|src|action|formaction|style)\s*=\s*['""]?)javascript:[^'""]*";

        // Replace occurrences of 'javascript:' with an empty string
        content = System.Text.RegularExpressions.Regex.Replace(content, pattern, "$1", System.Text.RegularExpressions.RegexOptions.IgnoreCase);

        // Assign the sanitized content back to the editor
        RadEditor1.Content = content;
    }

    Protected Sub Page_Load(sender As Object, e As EventArgs) Handles Me.Load
        Dim content As String = RadEditor1.Content

        ' Matches tags and attributes that can potentially execute JavaScript
        Dim pattern As String = "(<([a-zA-Z0-9]+)[^>]*?\s(?:to|href|xlink:href|src|action|formaction|style)\s*=\s*['""]?)javascript:[^'""]*"

        ' Replace occurrences of 'javascript:' with an empty string
        content = System.Text.RegularExpressions.Regex.Replace(content, pattern, "$1", System.Text.RegularExpressions.RegexOptions.IgnoreCase)

        ' Assign the sanitized content back to the editor
        RadEditor1.Content = content
    End Sub

  <telerik:RadEditor ID="RadEditor1" runat="server" OnClientLoad="OnClientLoad">
      <Content>
        <a href="javascript:alert('XSS')">Click me</a>
        <svg><use xlink:href="javascript:alert('XSS')"></use></svg>
        <img src="javascript:alert('XSS')" />
        <button formaction="javascript:alert('XSS')">Submit</button>
        <form action="javascript:alert('XSS')"></form>
        <svg>
            <set attributeName="href" to="javascript:alert('XSS')" />
            <animate attributeName="to" to="javascript:alert('XSS')" />
        </svg>
        <custom-tag href="javascript:alert('XSS')">Custom</custom-tag>

        <math><brute href="javascript:alert(1)">click</brute></math>
        <svg><a><rect width="99%" height="99%"></rect><set attributename="href" to="javascript: alert(1)"></set></a></svg>
      </Content>
  </telerik:RadEditor>
  <script type="text/javascript">
      function OnClientLoad(editor, args) {
          editor.get_filtersManager().add(new MyCustomSVGFilter());
      }

      function MyCustomSVGFilter() {
          MyCustomSVGFilter.initializeBase(this);
          this.set_isDom(true);
          this.set_enabled(true);
          this.set_name("MyCustomSVGFilter");
          this.set_description("Strips potentially dangerous attributes that contain 'javascript:' or other harmful values.");
      }

      MyCustomSVGFilter.prototype = {
          encodeScripts: function (contentToEncode) {
              // List of tags to inspect for dangerous attributes
              const tags = [
                  "a", "svg", "use", "img", "div", "button", "form",
                  "set", "animate", "custom-tag", "brute"
              ];

              // Attributes to check for harmful values
              const attributes = [
                  "href", "xlink:href", "src", "to", "formaction", "action", "style"
              ];

              for (let tag of tags) {
                  let elements = contentToEncode.getElementsByTagName(tag);

                  for (let element of elements) {
                      for (let attr of attributes) {
                          let value = element.getAttribute(attr);
                          if (value && this.isDangerous(value)) {
                              element.removeAttribute(attr);
                          }
                      }
                  }
              }

              return contentToEncode;
          },

          isDangerous: function (value) {
              // Identify dangerous values (e.g., starting with "javascript:")
              value = value.toLowerCase();
              return value.startsWith("javascript:") || value.includes("expression(");
          },

          getDesignContent: function (content) {
              return this.encodeScripts(content);
          },

          // The same logic applies when switching to HTML mode or submitting content
          getHtmlContent: function (content) {
              return this.encodeScripts(content);
          }
      };

      MyCustomSVGFilter.registerClass('MyCustomSVGFilter', Telerik.Web.UI.Editor.Filter);
</script>

 if (attr && attr.toLowerCase().indexOf("javascript") > -1) {

<script type="text/javascript">
    function OnClientLoad(editor, args) {
        editor.get_filtersManager().add(new MyCustomSVGFilter());
    }

    function MyCustomSVGFilter() {
        MyCustomSVGFilter.initializeBase(this);
        this.set_isDom(true);
        this.set_enabled(true);
        this.set_name("MyCustomSVGFilter");
        this.set_description("Strips set, animate and brute attributes that contain 'javascript:' as value");
    }

    MyCustomSVGFilter.prototype = {
        encodeScripts: function (contentToEncode) {
            var list = contentToEncode.getElementsByTagName("set");
            for (let item of list) {
                var attr = item.getAttribute("to");
                if (attr && attr.toLowerCase().indexOf("javascript") > -1) {
                    item.removeAttribute("to");
                }
            }
            list = contentToEncode.getElementsByTagName("animate");
            for (let item of list) {
                var attr = item.getAttribute("to");
                if (attr && attr.toLowerCase().indexOf("javascript") > -1) {
                    item.removeAttribute("to");
                }
            }

            list = contentToEncode.getElementsByTagName("brute");
            for (let item of list) {
                var attr = item.getAttribute("href");
                if (attr && attr.toLowerCase().indexOf("javascript") > -1) {
                    item.removeAttribute("href");
                }
            }

            return contentToEncode;
        },

        getDesignContent: function (content) {
            return this.encodeScripts(content);
        },

        // The code below is the same because it needs to be applied when switching to HTML mode and also when content is submitted. 
        getHtmlContent: function (content) {
            return this.encodeScripts(content);
        }
    }

    MyCustomSVGFilter.registerClass('MyCustomSVGFilterFilter', Telerik.Web.UI.Editor.Filter);
</script>