Merge commit from fork

* fix: strip event handlers during SSR

* whatever conduitry you're not that cool

* tweak

.changeset/chilly-comics-wear.md

@@ -0,0 +1,5 @@
+---
+'svelte': patch
+---
+
+fix: strip event handlers during SSR

packages/svelte/src/internal/server/index.js

@@ -158,6 +158,9 @@ export function attributes(attrs, css_hash, classes, styles, flags = 0) {
 			name = name.toLowerCase();
 		}
 
+		// omit event handler attributes
+		if (name.length > 2 && name.startsWith('on')) continue;
+
 		if (is_input) {
 			if (name === 'defaultvalue' || name === 'defaultchecked') {
 				name = name === 'defaultvalue' ? 'value' : 'checked';

packages/svelte/tests/server-side-rendering/samples/spread-attributes-event-handler-xss/_expected.html

@@ -0,0 +1,3 @@
+<div id="profile-123" class="card">content</div>
+
+<img src="x" alt="photo" />

packages/svelte/tests/server-side-rendering/samples/spread-attributes-event-handler-xss/main.svelte

@@ -0,0 +1,13 @@
+<script>
+	const userdata = {
+		id: 'profile-123',
+		class: 'card',
+		onclick: 'alert(1)',
+		onerror: 'alert(1)',
+		onfocus: 'alert(1)',
+		onmouseover: 'alert(1)'
+	};
+</script>
+
+<div {...userdata}>content</div>
+<img src="x" alt="photo" {...{ onerror: 'alert(1)', onload: 'alert(1)' }} />