From 0faa1facd3ec52d41239f1d17f8e898742128152 Mon Sep 17 00:00:00 2001
From: Jakub Vrana <jakub@vrana.cz>
Date: Wed, 18 Nov 2020 14:09:44 +0100
Subject: [PATCH] Ban setting special attributes

This prevents circumventing our checks by code like `<script
text="{$evil}">` or `<i innerHTML="{$evil}">` in Soy IDOM.

The newly added test is flaky. Any idea why?
---
 src/attributes.ts                  | 11 +++++++++++
 test/functional/attributes_spec.ts | 10 ++++++++++
 2 files changed, 21 insertions(+)

diff --git a/src/attributes.ts b/src/attributes.ts
index e3a87e79..585da565 100644
--- a/src/attributes.ts
+++ b/src/attributes.ts
@@ -139,6 +139,11 @@ function applyAttributeTyped(el: Element, name: string, value: unknown) {
   }
 }
 
+/** Throws an exception for setting forbidden attributes. */
+function applyForbiddenAttribute(el: Element, name: string, value: unknown) {
+  throw new Error("Invalid attribute " + name + ".");
+}
+
 /**
  * A publicly mutable object to provide custom mutators for attributes.
  * NB: The result of createMap() has to be recast since closure compiler
@@ -153,6 +158,12 @@ attributes[symbols.default] = applyAttributeTyped;
 
 attributes["style"] = applyStyle;
 
+attributes["innerHTML"] = applyForbiddenAttribute;
+attributes["innerText"] = applyForbiddenAttribute;
+attributes["outerHTML"] = applyForbiddenAttribute;
+attributes["text"] = applyForbiddenAttribute;
+attributes["textContent"] = applyForbiddenAttribute;
+
 /**
  * Calls the appropriate attribute mutator for this attribute.
  * @param el The Element to apply the attribute to.
diff --git a/test/functional/attributes_spec.ts b/test/functional/attributes_spec.ts
index b32b1255..20e323f6 100644
--- a/test/functional/attributes_spec.ts
+++ b/test/functional/attributes_spec.ts
@@ -290,6 +290,16 @@ describe('attribute updates', () => {
     });
   });
 
+  describe('for forbidden attributes', () => {
+    function render() {
+      elementVoid('div', null, null, 'innerHTML', 'x');
+    }
+    
+    it('should ban innerHTML', () => {
+      expect(() => patch(container, render)).to.throw('Invalid attribute innerHTML.');
+    });
+  });
+
   describe('for non-Incremental DOM attributes', () => {
     function render() {
       elementVoid('div');