JS: Restrict names of extracted HTML attributes

Author: asgerf

javascript/extractor/src/com/semmle/js/extractor/HTMLExtractor.java

@@ -143,6 +143,18 @@ public void handleElement(Element elt, HtmlPopulator.Context context) {
           }
       }
     }
+
+    @Override
+    public boolean shouldExtractAttributes(Element element) {
+      Attributes attributes = element.getAttributes();
+      if (attributes == null) return false;
+      for (Attribute attr : attributes) {
+        if (!VALID_ATTRIBUTE_NAME.matcher(attr.getName()).matches()) {
+          return false;
+        }
+      }
+      return true;
+    }
   }
 
   private boolean isAngularTemplateAttributeName(String name) {
@@ -153,6 +165,8 @@ private boolean isAngularTemplateAttributeName(String name) {
 
   private static final Pattern ANGULAR_FOR_LOOP_DECL = Pattern.compile("^ *let +(\\w+) +of(?: +|(?!\\w))(.*)");
 
+  private static final Pattern VALID_ATTRIBUTE_NAME = Pattern.compile("\\*?\\[?\\(?[\\w:_\\-]+\\]?\\)?");
+
   /** List of HTML attributes whose value is interpreted as JavaScript. */
   private static final Pattern JS_ATTRIBUTE =
       Pattern.compile(