XSS attribute filtering is inconsistent and strips valid attributes