Merge branch 'master' into cut-size-in-half

Author: developit

package.json

@@ -1,7 +1,7 @@
 {
   "name": "preact-render-to-string",
   "amdName": "preactRenderToString",
-  "version": "3.7.0",
+  "version": "3.7.2",
   "description": "Render JSX to an HTML string, with support for Preact components.",
   "main": "dist/index.js",
   "umd:main": "dist/index.js",

src/index.js

@@ -113,6 +113,9 @@ export default function renderToString(vnode, context, opts, inner, isSvgMode) {
 			let name = attrs[i],
 				v = attributes[name];
 			if (name==='children') continue;
+
+			if (name.match(/[\s\n\/='"\0<>]/)) continue;
+
 			if (!(opts && opts.allAttributes) && (name==='key' || name==='ref')) continue;
 
 			if (name==='className') {
@@ -156,6 +159,7 @@ export default function renderToString(vnode, context, opts, inner, isSvgMode) {
 	else if (pretty && ~s.indexOf('\n')) s += '\n';
 
 	s = `<${nodeName}${s}>`;
+	if (String(nodeName).match(/[\s\n\/='"\0<>]/)) throw s;
 
 	if (VOID_ELEMENTS.indexOf(nodeName)>-1) {
 		s = s.replace(/>$/, ' />');

test/render.js

@@ -56,6 +56,45 @@ describe('render', () => {
 			expect(render(<div foo={0} />)).to.equal(`<div foo="0"></div>`);
 		});
 
+		describe('attribute name sanitization', () => {
+			it('should omit attributes with invalid names', () => {
+				let rendered = render(h('div', {
+					'<a': '1',
+					'a>': '1',
+					'foo"bar': '1',
+					'"hello"': '1'
+				}));
+				expect(rendered).to.equal(`<div></div>`);
+			});
+
+			it('should mitigate attribute name injection', () => {
+				let rendered = render(h('div', {
+					'></div><script>alert("hi")</script>': '',
+					'foo onclick': 'javascript:alert()',
+					a: 'b'
+				}));
+				expect(rendered).to.equal(`<div a="b"></div>`);
+			});
+
+			it('should allow emoji attribute names', () => {
+				let rendered = render(h('div', {
+					'a;b': '1',
+					'a🧙‍b': '1'
+				}));
+				expect(rendered).to.equal(`<div a;b="1" a🧙‍b="1"></div>`);
+			});
+		});
+
+		it('should throw for invalid nodeName values', () => {
+			expect(() => render(h('div'))).not.to.throw();
+			expect(() => render(h('x-💩'))).not.to.throw();
+			expect(() => render(h('a b'))).to.throw(/<a b>/);
+			expect(() => render(h('a\0b'))).to.throw(/<a\0b>/);
+			expect(() => render(h('a>'))).to.throw(/<a>>/);
+			expect(() => render(h('<'))).to.throw(/<<>/);
+			expect(() => render(h('"'))).to.throw(/<">/);
+		});
+
 		it('should collapse collapsible attributes', () => {
 			let rendered = render(<div class="" style="" foo={true} bar />),
 				expected = `<div class style foo bar></div>`;