Function ɵɵvalidateAttribute

packages/core/src/sanitization/sanitization.ts:317–391

(value: T, tagName: string, attributeName: string)

 * @param attributeName The name of the attribute.
 */
export function ɵɵvalidateAttribute<T = any>(value: T, tagName: string, attributeName: string): T {
  const lowerCaseTagName = tagName.toLowerCase();
  const lowerCaseAttrName = attributeName.toLowerCase();

  const index = getSelectedIndex();
  const tNode: TNode | null = index === -1 ? null : getSelectedTNode();
  if (tNode && tNode.type !== TNodeType.Element) {
    return value;
  }

  // Leverage tNode.namespace if active, otherwise check both namespaced and base variants.
  const fullTagName =
    lowerCaseTagName[0] !== ':' && tNode?.namespace
      ? `:${tNode.namespace}:${lowerCaseTagName}`
      : lowerCaseTagName;

  const validationConfig = SECURITY_SENSITIVE_ELEMENTS[fullTagName]?.[lowerCaseAttrName];

  if (!validationConfig) {
    return value;
  }

  const lView = getLView();
  if (tNode && lowerCaseTagName === 'iframe') {
    const element = getNativeByTNode(tNode, lView) as RElement;
    enforceIframeSecurity(element as HTMLIFrameElement);
  }

  const displayTagName = tagName[0] === ':' ? tagName.split(':').pop()! : tagName;

  if (typeof validationConfig !== 'boolean') {
    if (!tNode) {
      const errorMessage =
        ngDevMode &&
        `Angular has detected that the \`${attributeName}\` was applied ` +
          `as a binding to the <${tagName}> element. ` +
          `For security reasons, the \`${attributeName}\` can be set on the <${tagName}> element ` +
          `as a static attribute only. \n` +
          `To fix this, switch the \`${attributeName}\` binding to a static attribute ` +
          `in a template or in host bindings section.`;
      throw new RuntimeError(RuntimeErrorCode.UNSAFE_ATTRIBUTE_BINDING, errorMessage);
    }

    const element = getNativeByTNode(tNode, lView) as SVGAnimateElement;
    const attributeNameValue = getSecuritySensitiveSVGAnimationAttributeName(
      element,
      validationConfig,
    );

    if (attributeNameValue) {
      const errorMessage =
        ngDevMode &&
        `Angular has detected that the \`${attributeName}\` was applied ` +
          `as a binding to the <${displayTagName}> element${getTemplateLocationDetails(lView)}. ` +
          `For security reasons, the \`${attributeName}\` can be set on the <${displayTagName}> element ` +
          `as a static attribute only when the "attributeName" is set to \'${attributeNameValue}\'. \n` +
          `To fix this, switch the \`${attributeNameValue}\` binding to a static attribute ` +
          `in a template or in host bindings section.`;