mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
3499a1321b
Currently, the SVG sanitizer checks a static set of candidate attribute names (`attributeName` and `attributename`). This approach misses other case variations (such as `attributenAme` or others), which could potentially bypass sanitization when binding sensitive attributes like `href` on `<set>` or `<animate>` elements. This change retrieves all attribute names of the SVG element, performs a case-insensitive comparison with `'attributename'`, and sanitizes the value if a match is found.