TYPO3 Core

Following looks like a bug to me:

I wanted to add an onclick attribute to an <a> tag.
As CKEditor uses onclick-Events it's recommend (or even necessary?) to use data attributes like

data-cke-pa-onclick

which should be parsed on output.

In the backend this gets parsed on save, so after saving the record I have <a onclick="something">.
Once I save this record then again (e.g. editors change some text in this record), the onclick gets removed as it's not allowed here.