RFC: Drop isAttributeNameSafe() check

[gaearon]

We currently validate DOM attributes on the client and ignore the ones with invalid names:

react/packages/react-dom/src/client/DOMPropertyOperations.js

Lines 202 to 204 in 0c164bb

	if (!isAttributeNameSafe(name)) {
	return;
	}

This check used to be important for safety when we did innerHTML rendering on the client side, but it's not anymore. If we just let it call setAttribute, the browser would throw on a bad attribute name.

This check used to run very infrequently (only for data attributes and custom elements), but now more attributes follow this code path (since any "simple" attributes with the same names are effectively treated as unknown attributes). So even though we cache the result, it seems unfortunate to do the work that the browser is already doing for us.

While this would be a breaking change (so it has to go in 17), I think we should just remove this check, and let the browser throw. This does make spreading props blindly a bit more dangerous, but we have a warning so it should be visible.

[Ethan-Arrowood]

@gaearon I can take this one if you don't mind

[gaearon]

It's just a proposal. Not actionable yet. I'd like a consensus from the team first, and then we'd need to wait with this until the next major (not soon).

[Ethan-Arrowood]

Ohh okay well I'm happy to take this when its time 👍

[nhunzaker]

This sounds fine to me. Especially if we keep the validation on SSR, which is the only edge case I can think of so far.

[nhunzaker]

We need to verify if componentDidCatch triggers on a bad attribute.

[gaearon]

Especially if we keep the validation on SSR, which is the only edge case I can think of so far.

That's pretty important to leave :-) It's why it was added.

[jquense]

I didn't realize we removed the innerHtml building, neat :)

[gaearon]

Oh yeah @sophiebits did this as part of 15.

[volkandkaya]

Is there a reason that

@data-attr fails isAttributeNameSafe

while

:data-attr is true

https://github.com/facebook/react/blob/c8369527efe0cdd1f95bb355c0616166a7816e1c/packages/react-dom-bindings/src/shared/isAttributeNameSafe.js

If there is no reason can i customise ATTRIBUTE_NAME_START_CHAR or can it be added to the regex?