JSFiddle - React, Tailwind, and code Playground

HTML

<div style="width:100%; height:100%; position:absolute; background: red" onmousemove="alert('xss')"></div>

JavaScript

function hookEvent(onevent, eventHash) {
    
    function scanElement(element) {
        
        // 跳过已扫描的事件
        var flags = element['_flag'];
        if (!flags) {
            flags = element['_flag'] = {};
        }
        if (typeof flags[eventHash] != 'undefined') {
            return;
        }
        flags[eventHash] = true;
        
        if (element.nodeType != Node.ELEMENT_NODE) {
            return;
        }
        
        var code = element.getAttribute(onevent);
        if (code && /xss/.test(code)) {
            element[onevent] = null;
            alert('拦截可疑代码: ' + code);
        }
        
        // 扫描上级元素
        scanElement(element.parentNode);
    }
    
    
    document.addEventListener(onevent.substr(2), function(e) {
        scanElement(e.target);
    }, true);
}

var i = 0;
for (var k in document) {
    if (/^on/.test(k)) {
        hookEvent(k, i++);
    }
}