Files
angular__angular/packages/core/test/render3
Alan Agius 3499a1321b fix(core): ensure SVG animation attributeName is checked case-insensitively
Currently, the SVG sanitizer checks a static set of candidate attribute
names (`attributeName` and `attributename`). This approach misses other case
variations (such as `attributenAme` or others), which could potentially
bypass sanitization when binding sensitive attributes like `href` on
`<set>` or `<animate>` elements.

This change retrieves all attribute names of the SVG element, performs a
case-insensitive comparison with `'attributename'`, and sanitizes the value
if a match is found.
2026-07-21 11:05:02 +02:00
..
…
…