JSFiddle - React, Tailwind, and code Playground

HTML

<a href="javascript:alert(/xss/)">Click Me</a>

JavaScript

function hookEvent(eventName) {
    var isClick = (eventName == 'onclick');
    
    document.addEventListener(eventName.substr(2), function(e) {
        var el = e.target;
        if (el.nodeType != Node.ELEMENT_NODE) {
            return;
        }
        
        // ...
        
        // 扫描 <a href="javascript:"> 的脚本
        if (isClick && el.tagName == 'A' && el.protocol == 'javascript:') {
            var code = el.href.substr(11);
            if (/xss/.test(code)) {
                el.href = 'javascript:void(0)';
                alert('拦截可疑事件:' + code);
            }
        }
    }, true);
}

for (var k in document) {
    if (/^on./.test(k)) {
        hookEvent(k);
    }
}