Guidance whitelisting arbitrary HTML attributes?

I don’t understand this request. You want average users to be able to inject arbitrary Javascript in your Discourse, by simply posting it in a reply? This would be a security nightmare.