fix(attributes): ignore attributes key with forbidden characters

Author: harshitha-cstk

__test__/attributes-to-string.test.ts

@@ -63,7 +63,7 @@ describe('Attributes to String', () => {
 
         const resultString = attributeToString(attr);
 
-        expect(resultString).toEqual(' style=\"text-align:left; \" rows=\"4\" cols=\"2\" colWidths=\"250, 250\" <ls=\""></p><h1>test</h1><p class="\"')
+        expect(resultString).toEqual(' style=\"text-align:left; \" rows=\"4\" cols=\"2\" colWidths=\"250, 250\"')
         done();
     });
     it('Should handle object attribute values correctly', done => {
@@ -125,4 +125,16 @@ describe('Attributes to String', () => {
         expect(resultString).toEqual(' safeKey="<script>alert(xss)</script>"');
         done();
     });
+    it('Should ignore attributes with forbidden characters in keys', done => {
+        const attr = {
+            "validKey": "safeValue",
+            'in"valid': "should be ignored",
+            "another>invalid": "should also be ignored"
+        } as Attributes;
+
+        const resultString = attributeToString(attr);
+
+        expect(resultString).toEqual(' validKey="safeValue"');
+        done();
+    });
 })

src/Models/metadata-model.ts

@@ -60,11 +60,7 @@ export function attributeToString(attributes: Attributes): string {
   let result = '';
   for (const key in attributes) {
     if (Object.prototype.hasOwnProperty.call(attributes, key)) {
-      // Sanitize the key to prevent HTML injection
-      const sanitizedKey = replaceHtmlEntities(key);
-
-      // Skip keys that contain forbidden characters (even after sanitization)
-      if (forbiddenAttrChars.some(char => sanitizedKey.includes(char))) {
+      if (forbiddenAttrChars.some(char => key.includes(char))) {
         continue;
       }
       let value = attributes[key];
@@ -76,14 +72,13 @@ export function attributeToString(attributes: Attributes): string {
           if (Object.prototype.hasOwnProperty.call(value, subKey)) {
             const subValue = value[subKey];
             if (subValue != null && subValue !== '') {
-              elementString += `${replaceHtmlEntities(subKey)}:${replaceHtmlEntities(String(subValue))}; `;
+              elementString += `${subKey}:${subValue}; `;
             }
           }
         }
         value = elementString;
       }
-      // Sanitize the value to prevent HTML injection
-      result += ` ${sanitizedKey}="${replaceHtmlEntities(String(value))}"`;
+      result += ` ${key}="${replaceHtmlEntities(String(value))}"`;
     }
   }
   return result;