Standard::filterXssDataAttributes

protected static Standard::filterXssDataAttributes($html)

protected static function filterXssDataAttributes($html) {
  if (stristr($html, 'data-') !== FALSE) {
    $dom = Html::load($html);
    $xpath = new \DOMXPath($dom);
    foreach ($xpath->query('//@*[starts-with(name(.), "data-")]') as $node) {
      // The data-attributes contain an HTML-encoded value, so we need to
      // decode the value, apply XSS filtering and then re-save as encoded
      // value. There is no need to explicitly decode $node->value, since the
      // DOMAttr::value getter returns the decoded value.
      $value = Xss::filterAdmin($node->value);
      $node->value = Html::escape($value);
    }
    $html = Html::serialize($dom);
  }

  return $html;
}