JSFiddle - React, Tailwind, and code Playground

HTML

<button onclick="console.log('xss')">CLICK ME</button>

JavaScript

document.addEventListener('click', function(e) {
    console.log('bubble');
});

document.addEventListener('click', function(e) {
    var element = e.target;
    var code = element.getAttribute('onclick');
    
    if (/xss/.test(code)) {
        e.stopImmediatePropagation();
        console.log('拦截可疑事件:', code);
    }
}, true);