setAttribute should happen after the whitelist check.