Merge pull request #5236 from asgerf/js/html-invalid-attr-name

Approved by erik-krogh

Author: codeql-ci

javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java

@@ -143,6 +143,18 @@ public void handleElement(Element elt, HtmlPopulator.Context context) {
           }
       }
     }
+
+    @Override
+    public boolean shouldExtractAttributes(Element element) {
+      Attributes attributes = element.getAttributes();
+      if (attributes == null) return false;
+      for (Attribute attr : attributes) {
+        if (!VALID_ATTRIBUTE_NAME.matcher(attr.getName()).matches()) {
+          return false;
+        }
+      }
+      return true;
+    }
   }
 
   private boolean isAngularTemplateAttributeName(String name) {
@@ -153,6 +165,8 @@ private boolean isAngularTemplateAttributeName(String name) {
 
   private static final Pattern ANGULAR_FOR_LOOP_DECL = Pattern.compile("^ *let +(\\w+) +of(?: +|(?!\\w))(.*)");
 
+  private static final Pattern VALID_ATTRIBUTE_NAME = Pattern.compile("\\*?\\[?\\(?[\\w:_\\-]+\\]?\\)?");
+
   /** List of HTML attributes whose value is interpreted as JavaScript. */
   private static final Pattern JS_ATTRIBUTE =
       Pattern.compile(

javascript/ql/test/query-tests/DOM/HTML/DuplicateAttributes.html

@@ -1 +1,3 @@
 <a href="https://semmle.com" href="https://semmle.com">Semmle</a>
+
+<td {% foo %} {% foo %}></td>