parser: remove old-style attributes in xss