diff -u b/core/includes/common.inc b/core/includes/common.inc
--- b/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -4350,7 +4350,7 @@
   }
   UrlValidator::setAllowedProtocols($allowed_protocols);
   // Set the allowed attributes once we have the config available.
-  $allowed_attributes = \Drupal::config('system.filter')->get('attributes');
+  $allowed_attributes = Drupal::config('system.filter')->get('attributes');
   if (!isset($allowed_attributes)) {
     // filter_xss_admin() is called by the installer and update.php, in which
     // case the configuration may not exist (yet). Provide a minimal default set
diff -u b/core/lib/Drupal/Component/Utility/Xss.php b/core/lib/Drupal/Component/Utility/Xss.php
--- b/core/lib/Drupal/Component/Utility/Xss.php
+++ b/core/lib/Drupal/Component/Utility/Xss.php
@@ -22,8 +22,10 @@
   protected static $adminTags = array('a', 'abbr', 'acronym', 'address', 'article', 'aside', 'b', 'bdi', 'bdo', 'big', 'blockquote', 'br', 'caption', 'cite', 'code', 'col', 'colgroup', 'command', 'dd', 'del', 'details', 'dfn', 'div', 'dl', 'dt', 'em', 'figcaption', 'figure', 'footer', 'h1', 'h2', 'h3', 'h4', 'h5', 'h6', 'header', 'hgroup', 'hr', 'i', 'img', 'ins', 'kbd', 'li', 'mark', 'menu', 'meter', 'nav', 'ol', 'output', 'p', 'pre', 'progress', 'q', 'rp', 'rt', 'ruby', 's', 'samp', 'section', 'small', 'span', 'strong', 'sub', 'summary', 'sup', 'table', 'tbody', 'td', 'tfoot', 'th', 'thead', 'time', 'tr', 'tt', 'u', 'ul', 'var', 'wbr');
 
   /**
-   * The list of Safe HTML attributes
-   * 
+   * The list of Safe HTML attributes.  The default values are the common values from
+   * https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet,
+   * Rule #7.
+   *
    * @var array
    */
   protected static $allowedAttributes = array('alt', 'lang', 'rel', 'title', 'value');
@@ -245,13 +247,13 @@
             // If the attribute is listed under the allowed and/or Safe HTML
             // allowed, then do not check for bad protocols.
             if (!isset($allowed_attributes[strtolower($attribute_name)])) {
-              $thisval = UrlValidator::filterBadProtocol($match[1]);
-            } 
+              $filtered_value = UrlValidator::filterBadProtocol($match[1]);
+            }
             else {
-              $thisval = $match[1];
+              $filtered_value = $match[1];
             }
             if (!$skip) {
-              $attributes_array[] = "$attribute_name=\"$thisval\"";
+              $attributes_array[] = "$attribute_name=\"$filtered_value\"";
             }
             $working = 1;
             $mode = 0;
@@ -261,13 +263,13 @@
 
           if (preg_match("/^'([^']*)'(\s+|$)/", $attributes, $match)) {
             if (!isset($allowed_attributes[strtolower($attribute_name)])) {
-              $thisval = UrlValidator::filterBadProtocol($match[1]);
+              $filtered_value = UrlValidator::filterBadProtocol($match[1]);
             }
             else {
-              $thisval = $match[1];
+              $filtered_value = $match[1];
             }
             if (!$skip) {
-              $attributes_array[] = "$attribute_name='$thisval'";
+              $attributes_array[] = "$attribute_name='$filtered_value'";
             }
             $working = 1; $mode = 0;
             $attributes = preg_replace("/^'[^']*'(\s+|$)/", '', $attributes);
@@ -276,14 +278,14 @@
 
           if (preg_match("%^([^\s\"']+)(\s+|$)%", $attributes, $match)) {
             if (!isset($allowed_attributes[strtolower($attribute_name)])) {
-              $thisval = UrlValidator::filterBadProtocol($match[1]);
+              $filtered_value = UrlValidator::filterBadProtocol($match[1]);
             }
             else {
-              $thisval = $match[1];
+              $filtered_value = $match[1];
             }
 
             if (!$skip) {
-              $attributes_array[] = "$attribute_name=\"$thisval\"";
+              $attributes_array[] = "$attribute_name=\"$filtered_value\"";
             }
             $working = 1; $mode = 0;
             $attributes = preg_replace("%^[^\s\"']+(\s+|$)%", '', $attributes);
diff -u b/core/modules/system/config/system.filter.yml b/core/modules/system/config/system.filter.yml
--- b/core/modules/system/config/system.filter.yml
+++ b/core/modules/system/config/system.filter.yml
@@ -11,7 +11,6 @@
   - sftp
   - webcal
   - rtsp
-
 attributes:
   - alt
   - lang